Skip to content

Campaign Inference

Cluster-level inference: domains/IPs sharing infrastructure with known campaigns. Each fires with named evidence and a 3-question analyst Q&A trail.

See 1 Campaign Inference signalsSee verdicts firing these
About

What Campaign Inference captures

Cluster-level inference: domains/IPs sharing infrastructure with known campaigns. Tier-1 SOC analysts use them to cut triage time on suspicious relational intelligence behavior; CTI teams pivot from them to the broader campaign graph.

Browse

1 signals in Campaign Inference

Each row opens a leaf page with the signal's direction, named evidence, and 3-question Q&A trail. Use them as audit anchors when a verdict surfaces this subgroup.

Campaign Inference1 signals
Verdict scenarios

How Campaign Inference shapes the call

Three real-world situations where Campaign Inference evidence dominates the decision. Verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A new domain whose infrastructure markers exactly match an active credential-theft campaign cluster mapped in the last 14 days.

VerdictIQ explains

“Decline. The asset belongs to a live malicious campaign by structural fingerprint. Treat as part of the parent operation.”

Medium riskVERDICT · REVIEW
The situation

A domain showing partial overlap with a campaign cluster that went dormant six months ago.

VerdictIQ explains

“Send to analyst review. The linkage is real but stale; verify whether the cluster has reactivated or the overlap is coincidental.”

Low riskVERDICT · ALLOW
The situation

A domain with no overlap with any known malicious campaign infrastructure.

VerdictIQ explains

“Allow. The asset sits outside any tracked campaign neighborhood. No campaign-side reason to delay.”

See full Verdict Gallery
Sibling subgroups

Other subgroups in Relational Intelligence

2 more subgroups in this group, each bundling signals that share a different mechanism. Tap one to inspect its signal names.

See subgroup detail
See subgroup detail

See Campaign Inference signals fire on your data

Free tier: 100 IOCs/day, LLM layer included.

Start FreeBack to Relational Intelligence