[chicagojoe]

FWIW, clicking around, there are some odd display issues in the "References" (h<b>ttp</b>s://attack.<b>mitre</b>.org/techniques/<b>T1486</b>)

It looks like you're embedding data from Twitter - are you paying for decahose/enterprise access or just paying for a low volume of high value tweets (i.e. I'm seeing many from FalconFeedsio, DailyDarkWeb)

[Bisen]

I can jump in on the data source question - we can track specific accounts and keywords on Twitter, we aren't paying for the full firehose yet. We also track those original ransomware and dark web sites and blogs being referenced and just figuring out how best to cluster them all into the same event. Thanks for checking it out!