Intelligence aggregation
Bring threat feeds and environmental signals into one platform.
THREAT INTELLIGENCE
ZelRank
Put the right threats first.
ZelRank aggregates threat intelligence feeds, environmental signals, and risk indicators, then ranks them by relevance and impact. AINA helps teams focus on threats that matter to their own environment.
ZelRank
Threat intelligence
ROCHESTON ZELFIRE ECOSYSTEM
BUILT FOR YOUR WORKFLOW
What you can do.
Contextual ranking
Evaluate relevance and impact instead of reviewing indicators in isolation.
Risk-led decisions
Give investigators a prioritized starting point for their work.
THE COMPLETE PRODUCT GUIDE
Explore ZelRank.
Get to know the capabilities, workflows, and intelligence behind the product.
About ZelRank
Powered by AINA, Rocheston ZelRank is a centralized Cyber Threat Intelligence (CTI) platform within the Zelfire Suite that transforms fragmented threat data into actionable, ecosystem-wide security intelligence.
AI-Driven Cyber Threat Intelligence Platform
ZelRank consolidates external threat feeds, premium intelligence sources, internal telemetry, and AI-driven analysis into a single platform. No more disconnected dashboards or siloed threat sources. Everything flows into one unified intelligence layer.
🔥 One platform. One intelligence truth. 🔥
Advanced IOC Management
Supports IPs, domains, URLs, hashes, certificates, email indicators, and behavioral artifacts with full normalization, deduplication, alias management, and canonical linking.
🧭 Every indicator structured. Every signal traceable. 🧭
Intelligent Feed Ingestion Engine
Ingests API, JSON, CSV, STIX, TAXII, and internal feeds with full observability, conflict handling, quarantine controls, and influence scoring.
🔗 Feeds are not chaos — they are supply chains. 🔗
Feed Influence Scoring
Each feed is weighted based on reliability, conflict rate, and contribution, ensuring transparent intelligence prioritization.
📏 Trust is measured, not assumed. 📏
Real-Time Ingestion Observability
Complete run logs, error tracing, processing breakdown, retry control, and quarantine review dashboards.
🛰️ Every ingestion visible. Every anomaly traceable. 🛰️
Confidence & Risk Explainability
ZelRank breaks down confidence and risk into feed weight, sightings impact, time decay, conflict penalties, and AI adjustments.
🔍 Explainable intelligence builds trust. 🔍
Multi-Product Correlation
Correlates detections across ZelXDR, ZelScan, ZelWall, ZelMap, ZelCloud, and external feeds to increase accuracy.
🧩 Correlation creates certainty. 🧩
Advanced Sightings Analytics
Velocity detection, spike analysis, source breakdown, and multi-product validation analytics.
📈 Patterns reveal intent. 📈
Intel Relationship Graph
Dynamic graph visualization of IOC relationships, clustering, pathfinding, and infrastructure mapping.
🕸️ Threats are networks. So is your defense. 🕸️
Threat Map Geo Intelligence
Interactive vector world map with heatmaps, clustering, geo filtering, and time-based playback.
🌍 See the threat landscape globally. 🌍
Campaign Intelligence Management
Track, analyze, and manage campaign lifecycles with attribution, MITRE mapping, and geo spread analysis.
📚 Campaigns are stories. ZelRank tells them. 📚
Cluster Detection Engine
Automatic grouping of related infrastructure using density modeling and AI-assisted pattern detection.
🧬 From fragments to formation. 🧬
Infrastructure Intelligence Sets
Identify high-density malicious infrastructure, shared nodes, multi-product confirmations, and dormant assets.
🏗️ Understand attacker infrastructure at scale. 🏗️
MITRE ATT&CK Integration
Full tactic and technique mapping, heatmaps, coverage analysis, and investigation-level alignment.
🎯 Strategic mapping meets tactical detection. 🎯
Investigation Workspace
Dedicated intelligence workspace combining IOCs, timeline, evidence, graph view, and AI-assisted summaries.
🗂️ Investigations deserve structure. 🗂️
AINA AI Intelligence Core
AI-powered threat briefs, IOC explanation, campaign narratives, anomaly detection, and predictive risk forecasting.
🤖 AI that understands intelligence. 🤖
Daily Threat Brief Automation
Generates executive and technical intelligence briefs with actionable recommendations.
⚡ From data to direction in seconds. ⚡
Velocity & Anomaly Detection
Identifies rapid changes in threat activity and highlights high-risk emerging indicators.
🚨 Speed reveals escalation. 🚨
TTL & Expiry Governance
Granular expiration policies per IOC type and per feed to prevent stale intelligence pollution.
⏱️ Fresh intelligence is accurate intelligence. ⏱️
Conflict Resolution Engine
Automatically detects and resolves feed verdict conflicts with transparent override controls.
🧮 Disagreement is analyzed, not ignored. 🧮
Feed Marketplace Ecosystem
Supports 40+ integrations including OTX, MISP, ThreatFox, MalwareBazaar, GreyNoise, and internal suite feeds.
🌐 An ecosystem, not a connector list. 🌐
Geo-Contextual Intelligence
Maps indicators to geographic distribution with region-level reporting and hotspot analysis.
🗺️ Threats move. We track their path. 🗺️
Risk Forecasting
AI-assisted predictions for infrastructure expansion, campaign escalation, and regional spread.
🔮 Intelligence should look forward. 🔮
Intelligence Overlap Analysis
Feed overlap matrices identify redundancy and highlight unique intelligence contributors.
🧪 Know what is unique. Remove what is redundant. 🧪
Report Generation & Branding
Executive-ready reports with customizable branding, cover pages, confidentiality labels, and export formats.
📝 Intelligence ready for the boardroom. 📝
Full Audit & Governance
Every action logged — ingestion, verdict changes, TTL updates, AI suggestions, investigations.
🧾 Transparency builds credibility. 🧾
Multi-Tenant Architecture
User-isolated intelligence environments with strict data separation and role-based access control.
🔐 Secure by architecture. 🔐
Scoring Engine Visualization
Interactive breakdown of how each indicator’s risk score is calculated.
🧯 See how intelligence is formed. 🧯
Suite-Level Integration
Native integration with ZelXDR, ZelScan, ZelMap, ZelWall, ZelCloud, and ZelSOAR.
🧠 Intelligence integrated across defense layers. 🧠
Built for RCCE
Exclusively licensed to RCCE students, ZelRank trains the next generation of cybersecurity engineers on real-world intelligence systems.
🏆 Master intelligence. Lead defense. 🏆
Designed for Complexity
CTI platforms are notoriously difficult to configure and integrate. ZelRank eliminates that complexity through structured ingestion, explainable scoring, and seamless integration.
🧭 Complexity engineered into clarity. 🧭
Enterprise-Grade Visual Intelligence
Dashboards, graphs, heatmaps, timelines, and analytics designed for operational and strategic teams alike.
🎛️ Intelligence you can see, measure, and act upon. 🎛️
The Future of CTI
ZelRank represents a shift from reactive intelligence collection to proactive, AI-enhanced, explainable cyber threat intelligence management.
🚀 The intelligence engine of tomorrow. 🚀
Powered by ZelC – Rocheston’s Cybersecurity Programming Language
ZelRank leverages ZelC to orchestrate intelligence workflows, manage autonomous AI agents, automate feed logic, and control scoring behaviors. Program enrichment pipelines, correlation rules, MITRE mappings, and investigation automation directly inside the engine.
🧠 ZelC gives intelligence the power of code. 🧠
Seamless Integration Across the Zelfire Ecosystem
ZelRank integrates natively with ZelXDR, ZelScan, ZelMap, ZelWall, ZelCloud, ZelSOAR, AINA, Reporting, Threat Map, Intel Graph, and Investigation Workspace for a synchronized, closed-loop intelligence ecosystem.
🌊 Intelligence that flows across every layer of defense. 🌊
Built for RCCE – The World’s Most Advanced Cybersecurity Training Program
Rocheston ZelRank is exclusively licensed to RCCE students and embedded in the curriculum as the primary CTI platform, enabling hands‑on experience with ingestion pipelines, scoring models, campaigns, clusters, infrastructure sets, graph and geo intelligence, AINA AI, and ZelC automation.
🎓 Learn CTI the way it runs in the real world — only in RCCE. 🎓
UNDER THE HOOD
Technical specifications.
Architecture, integrations, security controls, and operational details for ZelRank.
Unified Threat Intelligence Platform
ZelRank consolidates OSINT, premium feeds, internal telemetry, and AI-derived intelligence into a single platform for a unified intelligence layer.
Advanced IOC Management
Supports IPs, domains, URLs, hashes, certificates, email, and behavioral artifacts with normalization, deduplication, alias management, and canonical linking.
Intelligent Feed Ingestion Engine
Ingests API, JSON, CSV, STIX, TAXII, and internal feeds with observability, conflict handling, quarantine controls, and influence scoring.
Feed Influence Scoring
Weights feeds by reliability, conflict rate, and contribution to transparently prioritize intelligence.
Real-Time Ingestion Observability
Run logs, error tracing, processing breakdown, retry control, and quarantine review dashboards.
Confidence & Risk Explainability
Breaks down confidence and risk into feed weight, sightings impact, time decay, conflict penalties, and AI adjustments.
Multi-Product Correlation
Correlates detections across ZelXDR, ZelScan, ZelWall, ZelMap, ZelCloud, and external feeds to increase accuracy.
Advanced Sightings Analytics
Includes velocity detection, spike analysis, source breakdown, and multi-product validation analytics.
Intel Relationship Graph
Dynamic visualization of IOC relationships, clustering, pathfinding, and infrastructure mapping.
Threat Map Geo Intelligence
Interactive world map with heatmaps, clustering, geo filtering, and time-based playback.
Campaign Intelligence Management
Track and manage campaign lifecycles with attribution, MITRE mapping, and geo spread analysis.
Cluster Detection Engine
Automatic grouping of related infrastructure using density modeling and AI-assisted pattern detection.
Infrastructure Intelligence Sets
Identify high-density malicious infrastructure, shared nodes, multi-product confirmations, and dormant assets.
MITRE ATT&CK Integration
Full tactic and technique mapping, heatmaps, coverage analysis, and investigation-level alignment.
Investigation Workspace
Dedicated workspace combining IOCs, timeline, evidence, graph view, and AI-assisted summaries.
AINA AI Intelligence Core
AI-powered threat briefs, IOC explanation, campaign narratives, anomaly detection, and predictive risk forecasting.
Daily Threat Brief Automation
Generates executive and technical intelligence briefs with actionable recommendations.
Velocity & Anomaly Detection
Identifies rapid changes in threat activity and highlights high‑risk emerging indicators.
TTL & Expiry Governance
Granular expiration policies per IOC type and per feed to prevent stale intelligence pollution.
Conflict Resolution Engine
Automatically detects and resolves feed verdict conflicts with transparent override controls.
Feed Marketplace Ecosystem
Supports 40+ integrations including OTX, MISP, ThreatFox, MalwareBazaar, GreyNoise, and internal suite feeds.
Geo‑Contextual Intelligence
Maps indicators to geographic distribution with region-level reporting and hotspot analysis.
Risk Forecasting
AI-assisted predictions for infrastructure expansion, campaign escalation, and regional spread.
Intelligence Overlap Analysis
Overlap matrices identify redundancy and highlight unique intelligence contributors.
Report Generation & Branding
Executive-ready reports with customizable branding, confidentiality labels, and export formats.
Full Audit & Governance
Every action logged — ingestion, verdict changes, TTL updates, AI suggestions, and investigations.
Multi‑Tenant Architecture
User‑isolated intelligence environments with strict data separation and role‑based access control.
Scoring Engine Visualization
Interactive breakdown of how each indicator’s risk score is calculated with full explainability.
Suite‑Level Integration
Native integration across ZelXDR, ZelScan, ZelMap, ZelWall, ZelCloud, and ZelSOAR.
Built for RCCE
Exclusively licensed to RCCE students for hands‑on training with production‑grade CTI capabilities.
Designed for Complexity
Eliminates CTI complexity with structured ingestion, explainable scoring, and seamless integration.
Enterprise‑Grade Visual Intelligence
Dashboards, graphs, heatmaps, timelines, and analytics for operational and strategic teams.
The Future of CTI
Shifts from reactive collection to proactive, AI‑enhanced, explainable intelligence management.
Powered by ZelC
Program automation, AI agents, correlation rules, and scoring behaviors using Rocheston’s ZelC language.
Suite‑Wide Synergy
Seamless Zelfire ecosystem integration ensures a synchronized, closed‑loop intelligence workflow.
RCCE Training Program
Embedded in RCCE’s curriculum to teach real‑world CTI operations end‑to‑end.
INSIDE ZELRANK
The product, in detail.
Explore 12 product screenshots. Select any image for a closer look.
THE DETAILS THAT MATTER
ZelRank FAQ.
Answers about the product, its capabilities, and how it fits into your security workflow.
What is Rocheston ZelRank?
ZelRank is a next-generation Cyber Threat Intelligence (CTI) platform that collects, normalizes, enriches, correlates, analyzes, visualizes, and operationalizes threat intelligence. It is a core component of the Rocheston Zelfire cybersecurity suite and is powered by AINA, Rocheston’s AI intelligence engine.
Is ZelRank just another threat feed dashboard?
No. ZelRank is a full intelligence engine with feed ingestion pipelines, conflict resolution, scoring explainability, clustering, campaign management, infrastructure modeling, MITRE mapping, geo visualization, investigation workflows, AI analysis, and reporting — all within a unified architecture.
What types of indicators does ZelRank support?
- IPv4 and IPv6 addresses, CIDR ranges
- Domains and subdomains, URLs
- File hashes (MD5, SHA1, SHA256, SHA512), fuzzy hashes (optional)
- TLS/SSL certificate fingerprints, email indicators
- Behavioral indicators (registry keys, process names)
How does ZelRank handle duplicate indicators?
- Standardizes formats and removes duplicates
- Canonicalizes values, links aliases and variants
- Merges evidence intelligently
How does ZelRank calculate risk?
- Confidence and severity scores
- Feed reliability weighting and multi-product sightings
- Conflict penalties and time-decay adjustments
- AI-driven confidence boosts
Every score is explainable through a breakdown panel.
What feeds does ZelRank support?
- API, JSON, CSV, STIX, TAXII, custom connectors
- Internal suite feeds
- OTX, MISP, Abuse.ch, MalwareBazaar, GreyNoise, Emerging Threats
- Premium enterprise feeds and experimental AI feeds
How does ZelRank handle feed conflicts?
- Logs conflicts and applies feed weight influence
- Applies conflict resolution logic and allows manual override
- Maintains full audit transparency
Does ZelRank provide ingestion logs?
- Detailed run logs and processing breakdown
- Quarantine review and conflict resolution tracking
- API latency tracking, retry controls, SLA metrics
What is AINA in ZelRank?
- Generates daily threat briefs and executive summaries
- Explains indicators, suggests verdict changes, maps MITRE
- Detects anomalies, drafts investigation summaries, forecasts risk
Can ZelRank map threats to MITRE ATT&CK?
- Tactic and technique mapping
- Heatmaps, coverage analysis, and velocity tracking
- Investigation-level mapping and reporting
Does ZelRank include a threat map?
Yes. A vector-based global Threat Map with geo heatmaps, marker clustering, region breakdown, time playback, and overlays.
Does ZelRank include a relationship graph?
Yes. An interactive Intel Relationship Graph for relationships, clustering, pathfinding, infrastructure reuse, and risk flow modeling.
What are Campaigns in ZelRank?
Structured threat operations with lifecycle tracking, infrastructure aggregation, attribution scoring, MITRE mapping, geo spread analysis, and AI summaries.
What are Clusters in ZelRank?
Automatically or manually grouped related indicators based on relationship density, co‑occurrence, infrastructure overlap, and AI-assisted grouping.
What are Infrastructure Sets?
Infrastructure analysis across connectivity density, shared nodes, multi-product detection, evolution timeline, and campaign overlap.
Does ZelRank support investigations?
Yes. A structured workspace with linked IOCs, evidence tracking, timeline, graph and MITRE views, AI summaries, risk scoring, and reporting.
Can ZelRank generate reports?
Yes. Executive and technical reports, campaign briefs, MITRE coverage, threat map, investigation reports, branding, and exports.
How does ZelRank manage indicator expiration?
TTL governance with per-indicator and per-feed expiration, auto-expire rules, expiry analytics, and revival workflows.
Is ZelRank multi-tenant?
Yes. Data is isolated by user_id with strict role-based access control: Viewer, Analyst, Senior Analyst, Admin.
Does ZelRank integrate with other Zelfire products?
Yes. Native integration with ZelXDR, ZelScan, ZelMap, ZelWall, ZelCloud, ZelSOAR, Threat Map, Intel Graph, and AINA.
What is ZelC and how does it relate to ZelRank?
ZelC is Rocheston’s cybersecurity programming language used to program automation rules, manage AI agents, create correlation logic, customize ingestion, and define scoring adjustments.
How does ZelRank differ from traditional CTI platforms?
Unified ingestion, transparent scoring, AI-assisted analytics, cross-suite integration, enterprise observability, and built-in investigation workflows replace fragmentation and opacity.
Is ZelRank suitable for enterprise use?
Yes. Feed SLA monitoring, conflict resolution engine, audit logging, encryption of API keys, full observability, and structured governance.
Does ZelRank support geo analytics?
Yes. Maps indicator geo distribution, campaign spread, regional risk heatmaps, and country-level intelligence summaries.
Does ZelRank log all actions?
Yes. Ingestion runs, verdict changes, TTL updates, AI suggestions, investigation updates, feed modifications, and report generation.
Can ZelRank forecast threats?
Yes. AINA predicts campaign expansion, infrastructure growth, risk escalation, and emerging clusters.
Is ZelRank difficult to configure?
No. Structured feed management, explainable scoring, native integration, and simplified normalization and conflict resolution remove configuration nightmares.
Who can use ZelRank?
Rocheston ZelRank is exclusively licensed to RCCE students.
What makes ZelRank technically advanced?
- Multi-source correlation and feed influence modeling
- AI-assisted scoring with full explainability
- Geo + graph + MITRE integration
- Investigation-first architecture and ZelC automation
What is the vision behind ZelRank?
- Structured, explainable, integrated, visual
- AI-enhanced and operationally actionable
No matching questions. Try another word or clear the search.
Part of a connected security ecosystem.
Explore how AINA connects intelligence across Zelfire, and find the products that complement your workflow.
Detect & respond
ZelMap
Attack surface intelligence
Discover assets, understand exposure, and prioritize the risks that need attention.
Detect & respond
ZelXDR
Detection & response
Correlate endpoint, network, identity, and cloud signals into a connected incident view.
Detect & respond
ZelSOAR
Response automation
Coordinate response playbooks with approvals, orchestration, and audit trails.
LET’S CONNECT YOUR DEFENSE
Put Zelfire to work.
Explore the products, see the workflows, and talk to Rocheston about your security environment.
Request a demo