Aarvi AI — the intelligence layer under threat intelligence work

Getting Started

Deploying Aarvi Intelligence as a self-hosted platform is designed to be straightforward for teams familiar with Docker and standard container orchestration. Because data privacy is paramount, Aarvi runs entirely within your own infrastructure, ensuring that sensitive queries and results never leave your perimeter.

The standard deployment uses Docker Compose, orchestrating the core intelligence engine, the PostgreSQL database for entity mapping, and the Elasticsearch cluster for rapid historical search indexing. A typical setup requires a minimum of 16GB RAM and 4 CPU cores for the base platform, though scaling is highly recommended if you intend to enable all 50+ Dark Web and open sources simultaneously. Once the containers are running, initial configuration involves generating your master encryption keys and setting up the initial admin user via the secure setup wizard on port 3440.

Core Concepts

To use Aarvi effectively, it is helpful to understand how the platform processes and categorizes raw data into actionable intelligence. The system does not merely return raw keyword matches; it performs entity extraction using specialized natural language processing models tailored for cybersecurity contexts.

When a scan runs, Aarvi extracts Entities—such as cryptocurrency addresses, IP addresses, email domains, and CVE identifiers—and maps their relationships. Every extracted entity or keyword match is assigned a Priority Score (Critical, High, Medium, Low) based on the context of the finding. For example, a company domain mentioned alongside a known ransomware group's moniker will trigger a Critical score, whereas a generic mention in a benign discussion might score Low. This contextual scoring reduces alert fatigue and allows SOC teams to focus on verified threats.

Sources & Coverage

Aarvi continuously monitors over 50 distinct sources, which are categorized into four primary types to provide comprehensive coverage across the threat landscape.

Search Engines: Automated querying across specialized and deep-web search indexing services.
Directories & Repositories: Monitoring code repositories (like GitHub) and paste sites (like Pastebin) for accidental credential leaks or proprietary code exposure.
Underground Forums: Native Tor-based scraping of restricted-access Dark Web forums where initial access brokers and threat actors communicate.
Data Leaks & Ransomware Sites: Real-time tracking of dedicated leak sites (DLS) operated by ransomware cartels to detect early warnings of compromised vendors or direct breaches.

Administrators can selectively enable or disable specific sources based on their organization's risk profile and compliance requirements.

Reports & Export

Intelligence is only valuable if it can be communicated effectively. Aarvi includes a robust reporting engine capable of generating documents across 12 distinct methodologies, including Executive Briefings, Vendor Risk Assessments, and Threat Landscape Summaries.

Each report leverages AI to summarize complex data points into readable narratives. Reports can be scheduled to run automatically (e.g., a weekly brand exposure report) or generated on-demand during an active incident. To integrate with your existing toolchain and communication preferences, Aarvi supports 6 export formats: PDF and DOCX for human consumption, HTML for intranet embedding, JSON for custom parsing, and STIX/TAXII for direct ingestion into SIEMs and threat intelligence platforms.

Scheduling & Alerts

Manual querying is useful for incident response, but continuous protection requires automation. The Scheduling module allows users to define recurring scans based on saved queries, Info Cards, or specific Threat Actor profiles.

Schedules can be set to run hourly, daily, or weekly. When a scheduled scan detects new information that meets a predefined Priority Score threshold, the system triggers an alert. Alerts can be delivered via email to specific security teams, pushed to Slack/Teams channels via webhooks, or injected directly into a SIEM using the platform's API. This ensures that critical discoveries—such as a newly listed vulnerability on a tracked asset—are actioned immediately without requiring analysts to stare at dashboards.

API Overview

For advanced teams looking to build custom integrations, Aarvi provides a comprehensive RESTful API. The API surface closely mirrors the functionality of the graphical modules, allowing you to programmatically trigger scans, retrieve historical data, and manage entities.

Below are a few illustrative examples of the endpoint structure. Note that all API requests require an active Bearer token generated from the platform settings.

GET  /api/v1/entities/search?query=example.com
POST /api/v1/scans/trigger
GET  /api/v1/reports/latest?type=executive-brief