Grounded Handling Of Sourced Threat-intel
59 browser-based security tools for threat intelligence, vulnerability management, critical infrastructure monitoring, threat detection, and log analysis. No install required.
// Built with humans and AI — defending the homeland
🇺🇸
Ghost Defense eliminates the gap between what defenders need and what they can afford. Enterprise-grade threat intelligence, incident response, situational awareness, and a live cyber battlefield picture — 59 tools, zero installation, always free to access. All data sources TLP:CLEAR. Built with humans and AI — defending the homeland 🇺🇸
| Sector / Role | Primary Tools | Key Value |
|---|---|---|
| Government / SLTT | 10, 02, 06, 17, 20, 29 | Morning brief auto-generated. BOD 18-01 DNSSEC compliance. CI Threat Map for leadership. IR playbooks before incidents. |
| Healthcare / Hospital | 02, 06, 19, 22, 24, 29 | KEV patching for medical devices. Ransomware IR playbooks. Phishing defence. Log analysis for HIPAA incident detection. |
| Energy / Utilities | 04, 17, 22, 25, 26, 29 | ATG exposure map. ICS/OT IR playbook. Comms resilience monitoring. Nation-state threat tracking for energy sector. |
| Maritime / Port Security | 07, 25, 26, 28, 15 | Live AIS vessel tracking. Shadow fleet detection. Submarine cable threats. Emergency comms backup monitoring. |
| SOC / MSSP Analyst | 36, 10, 02, 31, 18, 32 | Daily brief in one click. Detection rule generation. Log and PCAP analysis. Attack surface enumeration for clients. |
| Incident Responder | 29, 24, 01, 19, 22, 13 | IR playbook in 30 seconds. Log and PCAP analysis. IP enrichment. Phishing forensics. Ransomware group ID. |
| CISO / Security Manager | 36, 33, 10, 17, 29, 32 | Executive morning brief. CI Threat Map for leadership reporting. Patch priority decisions. Exposure trend tracking. |
| Emergency Management | 25, 26, 27, 28, 07, 10 | Telecom outage detection. Satellite comms status. Aircraft situational awareness. Radio frequency monitoring. |
| Small / Underfunded Team | All 45 tools | Enterprise-grade capability at zero cost. Deploy in 30 seconds. No installation, no licensing, no ongoing cost. |
vuln:CVE-... or product:"..."), pick your sector or "All" to view without highlight, get a bar chart plus per-sector top-3 org receipts you can defend line by line. When a CVE is in the query, CVSS/EPSS/KEV/ransomware enrichment and a Shodan-suggested action pull from free CVEDB, and a detection-lag banner warns you when the CVE is under 30 days old. Optional custom sector override (org:, net:) measured by direct intersection instead of facet-bucketing. Print-clean layout. Costs 1 query credit per analyze (2 if custom). Pairs with Tools 43, 49 and 50.0xB10C OFAC mirror (refreshed nightly), Ransomwhere bulk dataset (~25k crowdsourced payment records), and per-chain block explorer for balance + tx count (Blockstream, Ethplorer, SoChain, XRPScan). All free, no API key. Screening datasets bulk-load once per session; per-address checks are local. Verdict language is honest: "no hits in screened sources" is stated as such, not as a legitimacy certification. Print-clean layout for IR briefings.country:US, so Regions 2 and 9 do not silently under-report. Five match modes — port, CVE, product fingerprint, raw banner text and free-form query — each with its own zero-result explanation naming the mode you should have used instead, because a silent zero in an exposure tool is a false-negative generator. A hardware-model guard catches part numbers like MicroLogix 1400 or PA-800 typed into product mode, where Shodan's vendor+service taxonomy guarantees a zero. Optional per-state denominator converts raw counts into an exposure rate so results are not simply ranked by population. The roll-up runs on free count queries; a separate credit-gated findings stage lists individual hosts with IP, port, product, org and Shodan-assigned location, sorted by KEV and ransomware association so the actionable rows surface first. Geolocation is labelled throughout as netblock-derived, not a physical site. Query audit prints every search string verbatim; CSV carries the same provenance. Pairs with Tools 49, 50, 52 and 57./ to search from anywhere. Opens with a live threat feed — RSS headlines pulled from CISA advisories, SANS ISC, Dragos, Talos, Unit 42, the DFIR Report and eight more, merged into one reverse-chronological stream with per-source toggles and anything under 24 hours flagged. Titles and links only; you read at the source. Also includes status checking with honest confidence tiers: routed through the Ghost Worker a check reports the real HTTP status code, while a direct browser probe can only prove the host answered — an opaque cross-origin response cannot distinguish 200 from 404, and the tool says so rather than painting every reachable host green. Checks run only when asked, are paced so they do not hammer other people’s servers, and cache for twelve hours. No API key, no account, nothing leaves the browser but the probes themselves.CISAv1/E:/A:/T:/M:/ vector for every finding — verifiable against CISA's own SSVC calculator. Observable factors (Exploitation, Technical Impact) are derived from vulnerability data; the two judgment factors (Automatable, Mission & Well-being) are human-in-the-middle, operator-set per finding and never auto-fabricated. Every decision carries its full 5 W provenance (what/why/who/when/where) and reads as a plain-English sentence. Complements Tool 06, which scores what's in KEV. CSV catalog export with vectors.