ClusterHawk Threat Intelligence Analysis Job ID: {{ content.summary.job_id }}

Analysis Summary

Total IPs Analyzed {{ content.summary.total_analyzed }}
Clusters Found {{ content.summary.clusters_found }}
Model Used {{ content.summary.model_used }}
Cluster Descriptions Available
Per-Prediction Explanations (why) Available
Trust Bands (kind) Confident: {{ content.summary.kind_distribution.confident_match }} Ambiguous (split): {{ content.summary.kind_distribution.ambiguous_split }} Ambiguous (diffuse): {{ content.summary.kind_distribution.ambiguous_diffuse }} Out of distribution: {{ content.summary.kind_distribution.out_of_distribution }} No input: {{ content.summary.kind_distribution.no_input_features }} Not covered: {{ content.summary.kind_distribution.no_covered_features }} Not enriched: {{ content.summary.kind_distribution.not_enriched }} Model has no opinion: {{ content.summary.kind_distribution.model_uninformative }}

Cluster Analysis

{{ name }} No fingerprint match Marker, not a cluster {{ info.description }}
Primary Characteristic: {{ info.description || 'N/A' }}
Key Indicators: {{ info.indicators || 'N/A' }}
IP Count {{ info.count }}
Average Confidence {{ info.avg_confidence | number:3 }} n/a
IP Addresses {{ ip }}

Predictions

IP Cluster Kind Label Confidence Effective N
{{ p.ip }} No match {{ p.cluster }}
{{ p.cluster_description }}
Confident Ambiguous (split) Ambiguous (diffuse) Out of distribution No input Not covered by this model Not enriched Model has no opinion - {{ p.label }} - {{ p.confidence | number:3 }} n/a {{ p.effective_n | number:2 }} -
Indicators: {{ p.cluster_indicators }}
Candidate clusters — top1 − top2 {{ (p.top1_minus_top2 * 100) | number:1 }}% : Cluster {{ c.cluster_id }} · {{ (c.confidence * 100) | number:1 }}%
Why this IP was assigned here Partial
The specific signals that drove THIS assignment — not typical hosts in the cluster.
This assignment also drew on proprietary features not shown here.
TOP Strongest signals pushing toward Cluster {{ p.explanation.target }}:
No single cluster fits decisively; closest are Cluster {{ p.explanation.candidates[0].cluster_id }} ({{ p.explanation.candidates[0].confidence * 100 | number:1 }}%) and Cluster {{ p.explanation.candidates[1].cluster_id }} ({{ p.explanation.candidates[1].confidence * 100 | number:1 }}%).
Best guess Cluster {{ p.explanation.target }} ({{ p.explanation.candidates[0].confidence * 100 | number:1 }}%), but the model is uncertain — probability spread across ~{{ p.effective_n | number:0 }} clustersmany clusters.
No cluster fits this host.
{{ s.label | uppercase }} {{ (s.weight < 0 ? -s.weight : s.weight) * 100 | number:0 }}% pull
{{ (('' + s.observed).indexOf('.') > -1 && (+s.observed % 1 === 0)) ? ('' + s.observed).split('.')[0] : s.observed }} — value present but not recognized by the model
not presented by this host
{{ (('' + s.observed).indexOf('.') > -1 && (+s.observed % 1 === 0)) ? ('' + s.observed).split('.')[0] : s.observed }}
TOP Strongest signals pulling away from Cluster {{ p.explanation.target }}:
{{ s.label | uppercase }} {{ (s.weight < 0 ? -s.weight : s.weight) * 100 | number:0 }}% pull
{{ (('' + s.observed).indexOf('.') > -1 && (+s.observed % 1 === 0)) ? ('' + s.observed).split('.')[0] : s.observed }} — value present but not recognized by the model
not presented by this host
{{ (('' + s.observed).indexOf('.') > -1 && (+s.observed % 1 === 0)) ? ('' + s.observed).split('.')[0] : s.observed }}
What separates Cluster {{ p.explanation.contrast.pair[0] }} and Cluster {{ p.explanation.contrast.pair[1] }}:
{{ s.label | uppercase }} {{ (s.weight < 0 ? -s.weight : s.weight) * 100 | number:0 }}% pull
{{ (('' + s.observed).indexOf('.') > -1 && (+s.observed % 1 === 0)) ? ('' + s.observed).split('.')[0] : s.observed }} — value present but not recognized by the model
not presented by this host
{{ (('' + s.observed).indexOf('.') > -1 && (+s.observed % 1 === 0)) ? ('' + s.observed).split('.')[0] : s.observed }}
TOP Toward Cluster {{ c.cluster_id }} ({{ c.confidence * 100 | number:1 }}%): TOP Weak accumulations toward Cluster {{ c.cluster_id }}: Cluster {{ c.cluster_id }} · {{ c.confidence * 100 | number:1 }}% · does not fit:
{{ s.label | uppercase }} {{ (s.weight < 0 ? -s.weight : s.weight) * 100 | number:0 }}% pull
{{ (('' + s.observed).indexOf('.') > -1 && (+s.observed % 1 === 0)) ? ('' + s.observed).split('.')[0] : s.observed }} — value present but not recognized by the model
not presented by this host
{{ (('' + s.observed).indexOf('.') > -1 && (+s.observed % 1 === 0)) ? ('' + s.observed).split('.')[0] : s.observed }}
Which models drove this decision:
{{ v.model.replace('model_', 'Model ') }} → Cluster {{ v.top_cluster }} {{ (v.share < 0 ? -v.share : v.share) * 100 | number:0 }}% pull
Presented by this host but matching nothing the model knows: {{ u }}
Why to be careful with this explanation: Out of distribution — resembles no trained cluster No cluster fits this host Quantized inference disagreed with the explained model — partial Quantized vs float inference diverged Partly driven by proprietary features not shown here {{ ct.charAt(0).toUpperCase() + ct.slice(1) }}
Feature coverage {{ p.explanation.explained_share * 100 | number:0 }}% of deciding models · {{ p.explanation.interpretable_share * 100 | number:0 }}% analyst-interpretable
No explanation available for this prediction ({{ p.explanation_status }}).

No prediction details available.

Error: {{ content.summary.error }}

ClusterHawk - Error for {{artifact.data}}
Error:
{{content.errorMessage}}