ThreatClawThreatClaw
The ThreatClaw agent
Overview of the open-source detection engine
Shadow AI & Governance
Shadow-AI inventory, risk scoring, EU AI Act
Export & Compliance
NIS2, GDPR, ISO 27001, EU AI Act, NIST CSF, 11 reports
Attack graph
STIX 2.1 + MITRE ATT&CK, predictive Threat Map
Modes & Integrations
Local LLM, Cloud, Hybrid, Slack, Teams, Wazuh, FortiGate, OPNsense
Specs & Self-hosted
Docker, Rust, hardware specs, AGPL v3
CISO 360 view
Real-time AI posture, Ed25519 audit, defensible evidence
Skills
Connectors & enrichments: Wazuh, OPNsense, Velociraptor…
Documentation
Install, configuration, usage guides
All rule packs6 400+ Sigma · 12 000+ YARA →
Detection
SigmaSIEM / EDRYARAfiles / memoryNIDS SuricatanetworkFalcocontainer / cloud
Vulnerabilities & AppSec
NucleiCVE / KEVWAFOWASP CRSSASTCWE / OWASPOPA / PolicyIaC compliance
DFIR & AI
osqueryhost queriesVelociraptorDFIR collectionLLM red-teamOWASP LLMIOCindicators
↓ Free demo pack.zip
PricingFAQContact

The agent is free. The rules are a subscription.

Two independent offers. Pick the one that concerns you, neither requires the other.

What are you looking for?
The ThreatClaw agent

The autonomous security agent, open source and free. Go Premium for human support and your rules kept current in real time inside your server.

See agent pricing →
Detection feeds

Content ready to plug into YOUR stack (SIEM, firewall, DNS, TIP): Sigma & YARA rules, IOC feed, and soon network and cloud. Sold separately.

See the feed catalogue →
The monthly recap

New rules, notable detections and actively exploited threats. One email a month, unsubscribe in one click.

ThreatClaw

Autonomous cybersecurity agent.

Product

  • The solution
  • Operating modes
  • Installation
  • Pricing

Resources

  • GitHub
  • Skills
  • FAQ
  • Blog
  • Bugs & Support
  • Discussions

Company

  • Contact
  • Become a partner
  • Legal
  • Privacy
  • AGPL v3 License
© 2026 ThreatClaw. AGPL v3 + Commercial.