Welcome to ICS Dossier™ Pro Suite! This guide will help you navigate and utilize all features of the dashboard. Our platform aggregates critical threat intelligence from 14+ authoritative sources, providing you with a comprehensive view of ICS/OT security threats, vulnerabilities, and advisories.
The ICS Dossier™ Pro Suite dashboard consists of three main columns:
The Main View is the central section of your dashboard where all intelligence events are displayed. This section contains:
The Main View displays Events. These are individual intelligence items that may include advisories, incidents, vulnerabilities (KEVs), or vendor-specific alerts from sources like Siemens, Schneider Electric, Rockwell Automation, and ABB. All intelligence items are referred to as "events" regardless of their category or source.
The left sidebar provides quick access to essential features:
The main view showing all intelligence feeds, charts, and filtering options.
Click to launch an interactive tour that walks you through all dashboard features. The tour is fully replayable and covers nine key areas:
The tour helps new users get up to speed quickly and serves as a reference for experienced users.
Click to open a comprehensive glossary of ICS/OT security terms and acronyms. The glossary includes definitions for technical terms, protocol names, threat categories, and industry-specific terminology.
Access your account settings and subscription information. See Section 11 for details on account management features.
Learn more about ICS Dossier™, our mission, and how we aggregate threat intelligence.
Opens this comprehensive guide in a new window.
Send us an email at dossier@somethingyouknow.io for support, questions, or feedback.
Return to the main ICS Dossier website.
The middle column contains powerful filtering tools to help you focus on relevant intelligence. Use Category, Country, Target, Attacker, and Relevance score to narrow your view to specific vendors, threats, and regions.
Filter events by type. Available categories include:
Incident KEV Schneider Siemens Rockwell ABB Advisory Research
Filter by countries mentioned in threat intelligence. This filter helps you track regional threat activity and geographic targeting patterns.
Filter by target sector (energy, manufacturing, water, transportation, etc.). Use this to focus on threats relevant to your industry or monitored infrastructure.
Filter by threat actor or adversary group. This helps track specific APT groups, ransomware operators, or nation-state actors.
Set a minimum and/or maximum relevance score to focus on the most critical alerts. Scores range from 0-100 based on:
The Main View features four visualization charts that provide at-a-glance insights into your threat intelligence data. These charts summarize events by category, country, target, and attacker, helping you spot spikes or patterns before diving into individual events.
What it shows: A horizontal bar chart displaying the count of events in each category (Incident, KEV, Schneider, Siemens, Rockwell, ABB, Advisory, Research).
How to read it:
What the data represents: This chart helps you quickly understand which types of intelligence are most prevalent in your current view. A spike in KEV events, for example, indicates an increase in known exploited vulnerabilities that require immediate attention.
What it shows: A horizontal bar chart displaying the top 10 countries mentioned in events.
What the data represents: This chart reveals which countries are most frequently referenced in current threat intelligence. High activity may indicate targeted campaigns, geographic vulnerability concentrations, or regional incident clusters.
What it shows: A horizontal bar chart displaying the top 10 target sectors or industries.
What the data represents: This chart shows which industries or sectors are currently facing the most threat activity. Spikes in specific sectors can indicate coordinated campaigns or vulnerability trends affecting particular infrastructure types.
What it shows: A horizontal bar chart displaying the top 10 threat actors or adversary groups.
What the data represents: This chart identifies which threat actors are currently most active. Tracking adversary activity over time helps understand campaign patterns and threat evolution.
Located in the top bar of the Main View, these buttons help you manage your dashboard view:
Purpose: Opens a network graph visualization showing relationships between selected events through shared CVEs, vendors, and sources.
How to use it:
The visualization helps identify patterns and relationships that may not be obvious when viewing events individually.
Available views:
Click to instantly clear all active filters and return the dashboard to its default state showing all events.
Events are the individual intelligence items displayed as cards in the Main View. Each event card represents an advisory, KEV entry, incident, or research item. Event cards contain titles, tags, scoring, and short summaries to help you triage quickly.
Each event card displays:
Individual Selection: Click the checkbox in the top-left corner of any event card to select it.
Multiple Selection: Click multiple event checkboxes to select several events at once. The selection counter at the top of the Main View will show how many events are currently selected.
The selection bar at the top of the event cards area provides powerful tools for managing and exporting your intelligence data. Use these buttons to export the current view as CSV, Markdown, PDF, or ePUB. Great for reports, offline reading, or sharing with your team.
Purpose: Selects all currently visible events in your filtered view.
Purpose: Deselects all currently selected events.
Purpose: Exports selected events to a CSV file for use in spreadsheet applications.
Best used for: Data analysis in Excel or Google Sheets, creating custom reports, sharing data with team members, importing into other security tools.
Purpose: Exports selected events in Markdown format for documentation and reporting.
Best used for: Creating documentation in GitHub, generating reports for wikis, sharing intelligence summaries via Slack or Teams.
Purpose: Exports selected events to a professionally formatted PDF document.
Best used for: Executive briefings and management reports, archiving intelligence reports, print-ready documentation.
Purpose: Exports selected events to an ePUB ebook format for reading on mobile devices and e-readers.
Best used for: Mobile reading on tablets and smartphones, offline access during travel.
The search bar at the top of the Main View allows you to quickly find events by keyword. Search within event text and see the total number of events in view. This is your starting point for narrowing an investigation.
Click "Glossary" in the left sidebar to open a comprehensive reference of ICS/OT security terminology. Open the Glossary to look up ICS/OT terminology, tactics, protocols, and vendor terms as you work through the feed.
The central display area of the ICS Dossier™ dashboard where all intelligence events are shown. The Main View contains visualization graphs, the search bar, filter controls, and event cards.
Computer systems that monitor and control industrial processes. ICS includes SCADA systems, DCS, and other control system configurations used in critical infrastructure.
Hardware and software that detects or causes change through direct monitoring and control of physical devices, processes, and events.
Vulnerabilities listed in CISA's catalog that are known to be actively exploited in the wild, requiring immediate attention.
Industrial digital computers adapted for the control of manufacturing processes, such as assembly lines and machinery.
| Format | Best Used For |
|---|---|
| CSV | Detailed analysis and data manipulation |
| Markdown | Documentation and team collaboration |
| Executive summaries and presentations | |
| ePUB | Mobile reading and offline access |
Access your account settings and subscription information by clicking "Account Home" in the left sidebar.
Something You Know™ grants you a limited, non-exclusive, non-transferable, revocable license to access and use ICS Dossier™ Pro Suite for your internal security and intelligence purposes only.
IMPORTANT LEGAL NOTICE
TO THE MAXIMUM EXTENT PERMITTED BY LAW:
If you have questions about these Terms of Use, please contact us at:
Email: dossier@somethingyouknow.io
Subject Line: "Terms of Use Inquiry"
Last Updated: December 2024
Effective Date: Upon access or use of ICS Dossier™ Pro Suite
We continuously improve ICS Dossier™ based on user feedback. Please share your suggestions for: