Threadlinqs — Threat Intel Enrichment

Live-highlight indicators of compromise on the sites you enable. Click any indicator for the threat report and detection rule.

Threadlinqs turns any threat report, advisory, or article into live intelligence. On sites you enable, it highlights every indicator of compromise it finds in the page text — IP addresses, domains, URLs, email addresses, file hashes, and CVE IDs — right where they appear. Click any highlighted indicator to instantly see what Threadlinqs knows about it: how many threats it appears in, its multi-source consensus/reputation, and the specific Threadlinqs threats it links to — without leaving the page. Then click any linked threat to open the full report in a movable window right on top of the page you are reading — summary and analysis, attribution, affected products, remediation, timeline, detection rules, indicators, ATT&CK technique coverage and related threats, across five tabs. Drag it, resize it, follow a related threat and come back. You never lose your place in the article. • The report comes to you. The threat report opens in a draggable, resizable window over the page — no new tab, no lost context. • Live highlighting, done locally. Scanning and highlighting happen entirely in your browser using the modern CSS Custom Highlight API — zero page modification, no layout breakage. Nothing is sent while you read. • Enrich on click. Only when you click an indicator is that single value sent to Threadlinqs; results are cached locally for 24 hours. • You choose where. The extension runs only on sites you explicitly enable, one at a time — never on every site by default — and stays off on banking, webmail, and login domains. • Your key, your data. Enrichment uses your Threadlinqs API key (the same key you use for MCP), stored only in your browser and sent only to intel.threadlinqs.com. Built for SOC analysts, threat hunters, and detection engineers who read a lot of threat content and want the corpus one click away. What you can see in a report matches your Threadlinqs plan exactly, the same as on the website: anyone can read the summary, analysis, timeline and ATT&CK mapping; detection rule logic needs a free account; indicator values, community corroboration and DNS enrichment need a paid plan. Anything above your plan is shown as a clearly labelled upgrade prompt rather than hidden. Requires a Threadlinqs account and API key for enrichment. Highlighting works without one.