Paste a sighting: JSON or YAML (Phase 2's format or frank/1, one or a list),
or a STIX 2.1 bundle. The preview runs in your browser, with the same code the server runs (WebAssembly):
these rows are everything that is shared. Organisation identities are never stored.
Partners download the sightings Parquet files and query them here, in the browser,
on db-core's column engine compiled to WebAssembly. Nothing is sent back. Counts, sums, minimums and
maximums merge across files; other results are shown per file.
A sighting is one row per IoC (seq 0, 1, …), its other fields repeated. Count
sightings or sum observations over WHERE seq = 0 OR seq IS NULL, or a sighting
counts once per IoC; its record (detail) and digest are on that row only.
sighting_id and digest are bytes, shown in hex; filter with x'…'.
FRANK does not judge
FRANK passes on what participants send. Every observable is kept, with the sender's own
words for it (its role, port, file name, ...); nothing is filtered on them. Whether an indicator
is malicious is for the reader to decide, with the sighting's confidence and the reporters behind it.
participants
who sees which TLP level
The sender chooses the TLP level of each sighting; a status sees its levels and those below. TLP:RED is refused: it is meant for named people, not for a platform.
who sees which field
An example message, each field marked with the lowest status that sees it (when the TLP level allows). Identities of the sender and the target are never stored.
sources
Country and network of IP addresses: IP Geolocation by DB-IP, licensed under CC BY 4.0.
Users with a role manage identities: an admin its own organisation's users and tokens, a superadmin every organisation. What a user may see still follows its organisation's status.
users
tokens
new organisation
audit
Machine clients use the same API as this page. Send Authorization: Bearer <token>;
the status of the token's participant decides what an endpoint returns. The full description is at
/v1/openapi.json.