The knowledge graph is an interactive map of every connection in this CTI knowledge base. Nodes represent individual CTI notes — threat actor profiles, MITRE ATT&CK technique breakdowns, campaign analyses, and foundational concepts. Edges are drawn from wikilinks and MITRE mappings embedded in each note, so the graph grows organically as new intelligence is published.

How to use the graph

The graph widget is available on every page of this site:

• Desktop — look for the graph panel in the right sidebar. Hover over any node to highlight its direct connections; click a node to navigate to that note.
• Full-screen mode — click the expand icon in the graph panel header to open an interactive full-screen view with zoom, pan, and search.

The graph is not a separate page you navigate to — it lives alongside the content, updating in real time as you move through the site.

What the graph shows

• CTI notes linked by shared threat actors, techniques, or indicators
• MITRE ATT&CK mappings surfaced as edges between technique notes and the reports that reference them
• Conceptual foundations — CTI fundamentals sits near the center of the graph because most notes reference core concepts defined there
• Landscape context — 2024 threat landscape connects to actor and campaign nodes that were active during that period

As new intelligence notes are automated and published, the graph density increases — making it the fastest way to find related material across the knowledge base.