AI Campaigns
Related IOCs clustered into daily campaign narratives by AI
AI Campaigns
Daily AI-clustered campaign narratives
AI clusters IOCs from the last 30 days into campaign narratives: shared infrastructure, malware family or targeted brand.
Generated daily by AI from the last 30 days of community IOCs.
Cohesion is how sure the AI is that these IOCs are ONE campaign. It is not a maliciousness score.
Frequently asked questions
What is an AI campaign on TweetFeed?
A campaign groups multiple IOCs reported by the community that AI detects as belonging to the same underlying operation - shared infrastructure, malware family, or targeted brand - seen over the last 30 days. The grouping itself, the name, the context narrative, the cohesion rating and the apparent target are AI-inferred; the counts, dates, IOC types, anchors and the raw IOCs underneath are derived deterministically from the feed.
How is campaign cohesion calculated?
Cohesion (high, medium, low) is the AI's assessment of how tightly the cluster holds together - how strongly the underlying IOCs appear related, not a maliciousness score or a verdict on any single indicator. Shared registrable domains, matching tags and overlapping reporters raise it; loosely related indicators lower it. Treat low cohesion as a lead to verify, not a verdict. The API field is still named confidence.
How often is the campaign data refreshed?
Campaigns are recomputed daily from a rolling 30-day window of TweetFeed IOCs. This page shows every campaign in the 30-day window by default - use the More control to narrow to campaigns still active this week. If a generation run fails, this page shows a stale-data warning and falls back to the last successful snapshot.
Where does the underlying IOC data come from?
The same source as the rest of TweetFeed: indicators of compromise shared publicly by infosec researchers on Twitter/X, deduplicated and published every 15 minutes. Campaign clustering is an AI layer on top of that same feed.
Why does a campaign show only 25 of 412 IOCs?
Each campaign publishes a sample of up to 25 IOCs to keep the response small; ioc_count is the real total. When a campaign has more IOCs than the sample, the Indicators panel says so honestly, offers a 'Load all' button where available, and the Reach the rest panel links out to the campaign's own domains and tags via Search so you can find the remaining IOCs today.