Security Intelligence

Security Intel answers security questions from Oyster’s own knowledge base, with the sources it used. It needs an account; open Security Intel under Blue Team.

What you can ask

• An exact identifier: a CVE, CWE, CAPEC, MITRE ATT&CK technique or D3FEND countermeasure. Exact identifiers are looked up directly rather than guessed.
• Known exploited vulnerabilities: “list known exploited vulnerabilities”.
• Detection, mitigation, incident response and cloud questions: “how do I detect T1055 process injection”, “how do I mitigate CWE-89 SQL injection”, “incident response steps for a ransomware outbreak”, “kubernetes cluster hardening best practices”.
• Package and prioritisation questions: “what vulnerabilities affect the npm package left-pad”, “what should I patch first: CVE-2021-44228 or CVE-2023-24489”.

The empty panel offers these as examples; click one to run it.

Reading an answer

Every answer shows a confidence badge:

• Grounded in local knowledge base — the answer is backed by retrieved records.
• Partial data — some fields may be incomplete. Treat it with more caution.

Sources are listed under the answer. Expand one to read the exact passage it came from, with its publisher and a link to the original where there is one. Some sources have a passage but no public link.

When there is no data

If an exact identifier is not in the knowledge base, you see Not found in local knowledge base. Oyster does not fabricate vulnerability data. Check the identifier for typos, then consult the vendor’s or the CVE record’s own advisory.

How it differs from chat

Chat answers from the model, and from your files when you ask about them. Security Intel answers from the curated knowledge base and always shows where each fact came from. Use Security Intel for facts about a specific identifier, and chat to discuss what they mean for you. See The knowledge base.