AI Campaigns
Related IOCs clustered into daily campaign narratives by AI
AI Campaigns
Daily AI-clustered campaign narratives
AI clusters IOCs from the last 30 days into campaign narratives: shared infrastructure, malware family or targeted brand.
AI-generated daily
Raw data: JSON API · per-campaign export (JSON/CSV/STIX) · API docs
Cohesion is how sure the AI is that these IOCs are ONE campaign. It is not a maliciousness score.
Frequently asked questions
What is an AI campaign on TweetFeed?
IOCs from the last 30 days that AI links to one operation. AI picks the grouping, name, context, cohesion and target. Counts, dates and IOCs come straight from the feed.
How is campaign cohesion calculated?
It is how sure the AI is that the IOCs are one campaign, not a maliciousness score. Shared domains, tags and reporters raise it. Treat low cohesion as a lead to verify. API field: confidence.
How often is the campaign data refreshed?
Daily, from a rolling 30-day window. Use More to show only campaigns active this week. If a run fails, the page shows a warning and the last good snapshot.
Where does the underlying IOC data come from?
The same TweetFeed feed: IOCs that researchers post on X, deduplicated every 15 minutes. Clustering is an AI layer on top.
Why does a campaign show only 25 of 412 IOCs?
Each campaign carries a sample of up to 25 IOCs. ioc_count is the real total. Use Load all where you see it, or Search for the campaign domains and tags.