ex4 Batch Run Report

Run 12–13 Oct 2026 · db/ex4_threatlens.db · 103/103 reports · 0 failed

This report covers the fourth full extraction run over the CTI corpus (docs/database/CTI/, 103 PDFs). The corpus was split into three contiguous batches (35 / 34 / 34 reports, sorted by filename). The batches ran one after another into a single fresh database, db/ex4_threatlens.db. Each report went through the same pipeline the dashboard's Ingest page uses: LLM extraction, quality checks, persistence, and a rescore of every stored indicator.

103/103

Reports processed (0 failed, 0 retried)

8h 17m

Total run time (18:06:43 → 02:23:45)

4m 50s

Mean time per report (median 3m 05s)

10,246

Candidates found by regex

5,026

Confirmed by the LLM (49.1%)

4,031

Passed quality checks

5,939

Unique indicators stored

6,239

Sightings (indicator × report)

Run configuration

Runner	`.dev_tools/run_ex_pipeline.py --batch K/3`, chained by `.dev_tools/run_ex_batches.sh`
Process host	`systemd-run --user` transient unit `ex4-batches`, detached from the terminal so it survives SSH/VS Code disconnects
Extraction engine	`llm` (`ioc_extract_llm_fs.py`: regex candidates → Ollama verification + scope profile)
Verification model	`qwen3.5:9b` (profiler `qwen3.5:9b`)
Ollama endpoint	A GPU server on the local network
LLM batch size / timeout	5 candidates per call / 300s (from `llm_calibration.conf` at the time, profile `gpu-high`; these settings are now `threatlens.conf [llm]`)
Sampling	`temperature: 0`, so output is deterministic for the same model, config and input
Schema	Alembic head (`b246eb301c95`, v1.5 source extraction engine); scoring_config (4 rows) and allowlist (16 rows) seeded from `seed.py`
Quality weights	Timeliness 0.25, accuracy 0.30, completeness 0.25, relevance 0.20 (the `seed.py` defaults, the same as ex2). The run itself scored with test weights left in `threatlens.conf` (0.00 / 0.10 / 0.70 / 0.20); the database was rescored with the default weights on 13 Oct, with timeliness evaluated as of the original scoring time, and the quality figures in this report reflect that. On the same day `first_seen` / `last_seen` were backfilled from report publish dates (they had been left empty, or set in ingest order) and the database rescored again as of the same time. Nothing else changed.
Failure handling	A batch that ends with failures is re-run once (stored reports are skipped). Not triggered in this run.

Batch summary

Batch	Reports	Start	End	Elapsed	Mean / report	Candidates	Confirmed	QA accepted	New indicators	Sightings
Batch 1/3	35/35	18:06:43	20:21:14	2h 14m	3m 51s	2,753	1,152	953	1,499	1,514
Batch 2/3	34/34	20:21:15	23:28:08	3h 07m	5m 30s	3,886	1,927	1,553	2,247	2,333
Batch 3/3	34/34	23:28:09	02:23:45	2h 56m	5m 10s	3,607	1,947	1,525	2,193	2,392

Batch 1 started 18:06:43 on 12 Oct; batch 3 finished 02:23:45 on 13 Oct. Each batch began within a second of the previous one ending.

Funnel: candidates to stored indicators

Stage	Count	% of candidates
Regex candidates extracted	10,246	100.0%
LLM verdict: confirmed IoC	5,026	49.1%
LLM verdict: context only (real observable, not malicious)	2,360	23.0%
LLM verdict: rejected	2,859	27.9%
Passed quality checks with no blocking flag	4,031	39.3%

Reading "QA accepted" vs "indicators stored". The persister also stores indicators that the quality checker flagged (for example verifier_rejected or benign_observable), with the flag attached, so the dashboard can show and triage them. The per-report New / Updated indicators counts are therefore larger than QA accepted. An indicator seen in several reports is stored once and gets one sighting per report.

Per-report detail

Every report in run order. The bar shows ex4 extraction time relative to the slowest report (36m 28s). ex3 time and Δ compare the same report in the previous run (db/ex3_threatlens.db). Click a column header to sort; hover a filename for the full name.

Batch:

B	#	Report / title	Published	Text chars	ex4 time	ex3 time	Δ	Candidates	Confirmed	Context	Rejected	QA accepted	New ind.	Updated ind.	Sightings	Reliability	Status
1	1	`009d86c3125e…` Sarcoma Ransomware Unveiled:	2025-05-19	0	2m 37s	2m 59s	-21.6s	47	12	7	28	10	36	0	36	79	done
1	2	`05fb542ed33e…` Shedding light on the ABYSSWORKER driver	2025-03-20	0	51s	1m 01s	-9.6s	13	7	2	4	6	12	0	12	100	done
1	3	`08e9e0ad5443…` 2025 IC3 ANNUAL REPORT	2026-04-16	0	1m 31s	1m 31s	+0.1s	40	1	7	32	1	6	0	6	88	done
1	4	`0e6937ecd0cf…` Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)	2026-08-03	0	3m 44s	3m 44s	-0.2s	78	53	19	6	35	47	0	47	68	done
1	5	`0ea0eb678ddf…` orova Ransomware Group Profile \| SOCRadar	2026-08-10	0	1m 31s	1m 31s	-0.2s	34	0	32	2	0	21	0	21	100	done
1	6	`1419874849a1…` Amatera Stealer 4.0.2 Beta: What's New in This Variant	2026-09-08	0	3m 05s	3m 05s	-0.2s	61	21	21	19	14	41	0	41	79	done
1	7	`151dc0a02c21…` Smoking Out an Affiliate	2026-04-13	0	3m 42s	3m 42s	-0.2s	84	35	20	29	22	50	0	50	71	done
1	8	`15f1556aca0d…` Tracing an Underground Military Data Network	2026-08-07	0	1m 12s	1m 12s	-0.2s	25	8	6	11	8	17	0	17	88	done
1	9	`18753b578e16…` Pulsar RAT Technical Malware Analysis Report	2025-06-13	0	5m 42s	5m 42s	-0.4s	126	31	68	27	29	59	2	61	88	done
1	10	`19dab96c4214…` “Checking all the Boxes”	2025-06-16	0	3m 08s	3m 11s	-3.0s	63	42	3	18	34	41	0	41	81	done
1	11	`19f38ef69590…` The Closed Quorum: Inside the first reported autonomous AI C2 implant	2026-09-22	0	4m 21s	4m 22s	-1.0s	63	13	33	17	12	25	0	25	92	done
1	12	`1e5aab47c71b…` WordlistLoader Delivering Amatera via ClearFake Campaigns	2026-08-18	0	3m 42s	3m 43s	-0.3s	62	60	2	0	48	51	0	51	82	done
1	13	`1ece5414b214…` Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets	2026-03-20	0	3m 46s	3m 47s	-0.5s	35	26	0	9	26	29	0	29	91	done
1	14	`1efcd0ae7a47…` Updated Cyber Threat Actor Naming System	2026-07-24	0	3m 10s	3m 10s	+0.2s	73	0	72	1	0	1	0	1	95	done
1	15	`207d8bd199d3…` Iranian Cyber Actors May Target Vulnerable US Networks and Entities of Interest	2025-06-27	0	37s	37s	-0.1s	13	0	1	12	0	6	1	7	54	done
1	16	`20a40ec6f8fb…` Trouble in the air: A spree of campaigns targeting the aerospace	2025-11-26	0	6m 09s	6m 09s	-0.3s	143	45	32	66	40	80	0	80	78	done
1	17	`21eea78f1664…` Don’t drop password	2025-05-07	0	7m 14s	7m 14s	+0.2s	159	93	50	16	69	89	2	91	79	done
1	18	`2f28b9f55b23…` CNCMahineRMS	2026-08-10	0	3m 30s	3m 32s	-2.2s	71	44	6	21	25	28	1	29	54	done
1	19	`344268fbe36f…` Lx(Base) RAT: A Technical Deep Dive	2026-08-03	0	3m 07s	3m 07s	-0.4s	64	19	32	13	18	28	4	32	92	done
1	20	`358b9454f721…` Actor Profiles, Extortion Tactics	2025-04-02	0	30s	30s	-0.1s	7	0	1	6	0	3	0	3	86	done
1	21	`359e937d1455…` How CrowdStrike Analyzes macOS Malware to Optimize Automated Detection	2022-05-06	0	1m 43s	1m 43s	+0.2s	28	10	1	17	10	18	0	18	68	done
1	22	`35af6dacfb1a…` Russia-Aligned TAG-110 Targets Tajikistan with Macro-Enabled Word Templates	2015-01-02	0	2m 07s	2m 07s	-0.1s	38	16	11	11	9	14	0	14	66	done
1	23	`38733da9e1eb…` Gunra Ransomware	2026-08-14	0	18s	18s	-0.1s	2	1	0	1	1	2	0	2	100	done
1	24	`38eeaa111502…` Hunting Active Threats in	2025-03-11	0	21s	22s	-0.1s	6	0	0	6	0	2	0	2	100	done
1	25	`390181c309be…` Page 2 / 37	2026-02-20	0	23m 37s	23m 36s	+0.8s	449	375	42	32	362	393	0	393	95	done
1	26	`39e53915de46…` MacProStorage02:_2018ROW:Bitdefender-Whitepaper-Inexsmar-crea1598-A4-en_EN:Bitdefender-Whi	2017-07-18	0	1m 23s	1m 49s	-25.9s	3	0	0	3	0	2	0	2	67	done
1	27	`3a73704681d0…` ESET APT Activity Report Q4 2024-Q1 2025	2025-05-12	0	2m 22s	2m 22s	-0.4s	57	16	33	8	10	21	2	23	88	done
1	28	`4133fba19a65…` VAIZ, FDN3, TK-NET: A nebula of Ukrainian networks engaged in brute	2025-08-28	0	7m 30s	7m 31s	-0.3s	166	96	8	62	84	119	0	119	80	done
1	29	`44d819fbd466…` VShell	2025-11-03	0	3m 36s	3m 49s	-12.8s	77	7	15	55	5	56	0	56	86	done
1	30	`485ca080f5d6…` SPECIAL REPORT: MANDIANT M-TRENDS 2023	2025-04-24	0	14m 07s	14m 07s	+0.1s	381	14	302	65	5	35	0	35	60	done
1	31	`48d880a5ad51…` Borrowed Machinery: SnappyClient, HijackLoader, and a Shared Codebase?	2026-09-08	0	1m 03s	1m 03s	-0.2s	12	3	4	5	3	10	2	12	100	done
1	32	`4ab76f396dd4…` WithSecure STINGR Research	2026-01-16	0	5m 27s	5m 27s	-0.4s	104	29	18	57	16	60	0	60	63	done
1	33	`4dc4cfdd02b7…` Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor	2026-08-02	0	2m 19s	2m 19s	+0.0s	44	32	3	9	26	27	0	27	68	done
1	34	`4f93190676d2…` Dark Web Profile: ExfilSquad	2026-07-28	0	35s	35s	-0.1s	10	3	2	5	1	2	0	2	40	done
1	35	`5194fba6d2b2…` DECEPTIVEDEVELOPMENT: FROM PRIMITIVE	2025-09-16	0	4m 55s	4m 55s	-0.3s	115	40	9	66	24	68	1	69	67	done
2	1	`51ba4d92c4f0…` Advances in Threat	2025-11-05	0	52s	2m 00s	-67.8s	17	1	12	4	1	2	0	2	76	done
2	2	`554c01c9451f…` Techniques, trends, & takeways	2025-03-12	0	5m 19s	5m 26s	-7.0s	125	26	49	50	18	46	9	55	74	done
2	3	`55617e8588b2…` Credential harvesting that survives takedowns: REVSTEALER	2026-09-02	0	3m 22s	3m 29s	-7.0s	45	31	4	10	25	30	0	30	69	done
2	4	`56357662a440…` Decoding the Accelerated	2026-03-17	0	2m 44s	2m 47s	-2.2s	53	6	12	35	1	2	0	2	68	done
2	5	`5b4c8593232d…` G L O B A L T H R E A T	2025-02-27	0	9m 33s	9m 32s	+0.8s	250	10	61	179	0	8	2	10	77	done
2	6	`5bf5c8f4e073…` ResidentBat: A new spyware family used by Belarusian KGB	2025-12-17	0	6m 31s	6m 30s	+0.4s	150	48	5	97	48	125	0	125	83	done
2	7	`5ce9bb6c1454…` Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads	2026-08-10	0	28s	1m 24s	-55.7s	6	2	1	3	2	4	1	5	100	done
2	8	`6a6519ae34ff…` Infrastructure in the Shadows:	2026-01-15	0	1m 06s	1m 05s	+0.3s	14	8	0	6	6	8	0	8	64	done
2	9	`6b28d9bd3357…` GOOGLE CALENDAR AS C2 INFRASTRUCTURE:	2025-09-16	0	2m 05s	2m 05s	+0.3s	45	14	10	21	8	23	4	27	76	done
2	10	`6b8d1b3feb7d…` 5Socks TLP-CLEAR FLASH 05.13.25.pdf	2025-05-13	0	3s	3s	+0.0s	0	0	0	0	0	0	0	0	0	done
2	11	`6e059a147c07…` BADBAZAAR and MOONSHINE: Technical analysis and mitigations	2025-04-08	0	16m 03s	16m 03s	+0.1s	368	220	32	116	197	302	4	306	92	done
2	12	`6f9651727d7a…` UNIT 42 PLAYBOOK VIEWER	2026-08-10	0	8m 25s	8m 33s	-8.6s	97	76	0	21	75	94	0	94	98	done
2	13	`702cbf9ce153…` RUSSIA-ALIGNED APTs RAMP UP ATTACKS	2025-10-30	0	3m 59s	3m 59s	-0.1s	94	51	26	17	38	44	4	48	80	done
2	14	`75c28bab07aa…` P á g i n a 1 \| 35	2025-04-01	0	1m 49s	1m 49s	+0.0s	30	18	5	7	17	21	0	21	97	done
2	15	`762f6e186379…` North Korean Kimsuky Actors Leverage Malicious QR	2026-01-06	0	53s	53s	-0.1s	16	0	9	7	0	0	3	3	50	done
2	16	`764d71dadafd…` GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT	2015-01-02	0	23m 46s	23m 43s	+2.1s	508	377	33	98	352	438	5	443	93	done
2	17	`76a0d9979930…` BatShadow Threat Research Report	2025-09-25	0	6m 22s	6m 03s	+18.5s	63	32	19	12	21	26	2	28	81	done
2	18	`76f60b9eb3b6…` From espionage to PsyOps: Tracking operations and bulletproof	2025-03-28	0	12m 13s	12m 12s	+1.2s	271	138	38	95	116	171	10	181	80	done
2	19	`7ac0a8fc12a5…` MONITORING OIL SHIPMENTS, TARGETING DRONE MAKERS	2026-05-22	0	3m 36s	3m 36s	+0.3s	85	52	16	17	42	46	4	50	87	done
2	20	`7c375e86a165…` ACR Stealer: Two observed intrusion chains amid increased threat activity	2026-07-16	0	2m 16s	2m 16s	+0.2s	46	19	17	10	17	23	6	29	67	done
2	21	`7fe55fffa7eb…` ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft	2026-09-25	0	4m 32s	4m 32s	+0.6s	101	29	22	50	16	47	1	48	67	done
2	22	`83aec13b004b…` How North Korea-Backed Lazarus Group Is Weaponizing Open Source to Target Developers	2025-07-29	0	52s	52s	+0.0s	16	3	2	11	2	4	1	5	56	done
2	23	`84caad27e0b8…` TerraStealerV2 and TerraLogger: Golden Chickens’ New Malware Families Discovered	2015-01-02	0	4m 45s	4m 45s	+0.3s	101	69	7	25	54	62	5	67	72	done
2	24	`8a81015fdb3b…` A Deep Dive into the	2025-04-07	0	2m 49s	2m 49s	-0.1s	51	8	26	17	7	14	1	15	73	done
2	25	`8e8f1aed7012…` Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and Targeting	2025-07-21	0	14m 15s	14m 15s	+0.2s	308	285	10	13	278	280	2	282	95	done
2	26	`8ea56be5c921…` ta458 roundpress exploits	2026-07-15	0	3m 26s	3m 57s	-30.7s	45	25	8	12	17	19	1	20	82	done
2	27	`91f90a05c5ca…` Head Mare доставляет бэкдоры PhantomCore и PhantomGraph через необновленный сервер TrueCon	2026-08-07	0	4m 08s	4m 08s	-0.3s	78	62	8	8	46	54	3	57	74	done
2	28	`92b71dd407e5…` Investigating Iranian Intrusion into Strategic	2025-03-07	0	21m 43s	21m 43s	+0.0s	498	250	86	162	104	197	6	203	46	done
2	29	`96ae57a4444b…` Who Invited Aisuru to the LAN Party?	2026-08-18	0	2m 46s	2m 50s	-4.5s	41	23	8	10	22	34	2	36	93	done
2	30	`9c9c752b1c98…` Dark Web Profile: ShinyHunters	2024-03-18	0	55s	55s	-0.1s	17	0	16	1	0	1	0	1	94	done
2	31	`a0ad0d61a7e0…` Beyond the Batch File: Analysis of a Multi‑Stage DonutLoader Infection Chain	2026-08-03	0	3m 07s	3m 07s	+0.0s	68	23	25	20	12	16	7	23	62	done
2	32	`a122089dc5b9…` EXPOSING DPRK’S CYBER SYNDICATE AND HIDDEN IT WORKFORCE	2025-05-14	0	8m 18s	8m 18s	-0.6s	206	4	24	178	1	80	2	82	55	done
2	33	`a352ce27bb67…` “Dissecting a new malspam	2025-11-25	0	2m 58s	2m 59s	-0.3s	63	17	32	14	10	20	1	21	84	done
2	34	`ace2c3b4db7c…` Cisco Cyber Vision Active Discovery Configuration Guide, Release 4.3.0	2022-05-06	0	54s	54s	-0.1s	10	0	5	5	0	6	0	6	60	done
3	1	`b0a44eca5096…` 2025 년 8 월 둘째 주, 위협 동향 보고서	2025-08-14	0	2m 42s	2m 42s	-0.1s	41	33	5	3	30	34	3	37	93	done
3	2	`b2a76c6f6992…` Threat Intelligence Report:	2025-08-25	0	2m 27s	2m 27s	-0.3s	57	5	11	41	4	9	3	12	81	done
3	3	`b3f683dffc95…` cyber	2025-06-23	0	3m 23s	3m 23s	+0.1s	74	41	10	23	35	50	4	54	82	done
3	4	`b46c384eb9dd…` Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit	2026-07-28	0	1m 21s	1m 21s	-0.1s	28	6	13	9	6	11	0	11	57	done
3	5	`bad9c0924ab8…` gammax Ransomware Group Profile \| SOCRadar	2026-08-09	0	59s	59s	-0.2s	22	0	17	5	0	5	0	5	86	done
3	6	`be85714cb00c…` Threat Actor Report	2025-07-16	0	2m 26s	2m 27s	-0.2s	48	18	17	13	17	40	1	41	94	done
3	7	`bea35aee7aec…` BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil	2025-04-08	0	4m 57s	4m 56s	+0.4s	116	2	0	114	2	12	97	109	96	done
3	8	`bf692be40212…` DAMASCENED PEACOCK	2025-04-08	0	3m 36s	3m 36s	-0.4s	53	17	14	22	14	29	4	33	87	done
3	9	`c0b6b55f4177…` Page 2 / 60	2025-08-01	0	20m 48s	20m 50s	-2.6s	485	267	130	88	247	369	5	374	88	done
3	10	`c0d8d04892e8…` ClearSky report on BadPaw and MeowMeow Russian malware	2026-03-02	0	2m 11s	1m 49s	+22.2s	29	12	6	11	5	8	0	8	45	done
3	11	`c606a5ff18f5…` DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal	2015-01-02	0	2m 28s	2m 28s	-0.2s	50	20	15	15	16	19	6	25	64	done
3	12	`cc5d8d13eff5…` TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains	2026-07-16	0	5m 50s	5m 50s	+0.0s	124	88	21	15	83	96	9	105	90	done
3	13	`cf10f938c88f…` Cyber Criminal Group TeamPCP	2026-07-01	0	2m 44s	2m 44s	-0.3s	55	44	4	7	40	41	3	44	87	done
3	14	`d0ecf1b8d3d7…` Mirage Kitten targets Middle East and Africa region with new malware	2026-07-28	0	4m 54s	4m 54s	+0.6s	61	44	4	13	40	46	3	49	90	done
3	15	`d3797335f047…` Contec CMS8000 Contains a Backdoor	2025-01-30	0	46s	47s	-0.4s	13	5	3	5	2	5	2	7	77	done
3	16	`d45a240c2e60…` Operation Marstech Mayhem	2025-02-10	0	1m 11s	1m 11s	-0.1s	27	12	5	10	8	10	3	13	74	done
3	17	`d793c8e7b0c7…` RedMike (Salt Typhoon) Exploits Vulnerable Cisco Devices of Global Telecommunications Prov	2025-02-12	0	36s	36s	+0.1s	15	1	11	3	0	0	1	1	80	done
3	18	`d91a947ba961…` This report delivers a comprehensive technical analy-sis of BRICKSTORM, an espionage backd	2025-04-09	0	5m 59s	5m 59s	-0.5s	101	19	3	79	15	70	3	73	77	done
3	19	`db51b31b6447…` Kimsuky Threat Research Report-2	2025-07-25	0	6m 06s	6m 06s	-0.2s	133	42	31	60	33	64	10	74	77	done
3	20	`db638f5be9aa…` ESET Research white papers	2026-04-20	0	5m 19s	5m 19s	+0.1s	114	26	55	32	20	41	6	47	77	done
3	21	`ddfb075f6b35…` TAG-144’s Persistent Grip on South American Organizations	2015-01-02	0	36m 28s	37m 32s	-63.6s	829	756	29	44	462	491	6	497	63	done
3	22	`e0a741c74ad2…` Prompts as Code & Embedded Keys \| The Hunt for LLM-Enabled Malware	2025-09-19	0	6m 08s	6m 23s	-15.3s	51	39	1	11	39	45	0	45	90	done
3	23	`e557448d4f67…` The Governmental Computer Emergency Response Team of Ukraine CERT-UA received	2022-04-01	0	1m 28s	1m 28s	-0.2s	16	14	0	2	11	11	0	11	69	done
3	24	`e5fe074eecf1…` Scattered Spider	2025-08-01	0	3m 47s	3m 47s	+0.1s	86	8	55	23	7	16	0	16	73	done
3	25	`e7108172f4d0…` Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTT	2026-07-24	0	2m 42s	2m 42s	+0.2s	50	32	7	11	23	31	5	36	74	done
3	26	`e7a254638c47…` 2025 Cyber Threat Intelligence Report	2025-06-24	0	2m 31s	2m 30s	+0.5s	46	1	28	17	1	8	2	10	89	done
3	27	`ea9531b3ba3b…` ModernStealer Threat Actor Linked to Government and Defense Data-Leak Claims	2026-08-03	0	37s	36s	+0.3s	10	0	1	9	0	1	8	9	90	done
3	28	`ee4fa19b26a0…` Vidar Infostealer in Action	2025-08-28	0	2m 17s	2m 17s	-0.1s	45	12	15	18	10	14	4	18	78	done
3	29	`f14bf3978e27…` © 2 026 Dragos, Inc. All R ights R eserved. Prop rietary & Confiden ti al.	2026-03-25	0	2m 20s	2m 20s	+0.4s	43	0	21	22	0	0	0	0	74	done
3	30	`f7e7a0a1f1ba…` Energy Sector Incident Report – 29 December	2026-01-30	0	7m 31s	7m 31s	+0.7s	161	57	67	37	41	58	5	63	78	done
3	31	`f87b9315b436…` Beyond Potentially Unwanted Apps: Malware Behind Fake PDF Converters	2025-12-04	0	2m 58s	2m 58s	-0.1s	58	52	1	5	44	50	0	50	90	done
3	32	`fb0660fd3945…` TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base	2015-01-02	0	23m 19s	23m 17s	+1.5s	533	260	252	21	257	493	6	499	96	done
3	33	`fdf53fac0af9…` North Korea-linked APT attack found disguised as a	2022-02-21	0	58s	1m 21s	-22.9s	3	2	0	1	2	2	0	2	67	done
3	34	`preparing-fo…` Russia-Ukraine Cyberattacks (Updated):	2025-06-04	0	1m 51s	1m 51s	+0.1s	30	12	18	0	11	14	0	14	93	done
Total (103 reports)					8h 17m			10,246	5,026	2,360	2,859	4,031	5,939	300	6,239

Timing

Ten slowest reports

Report	Batch	Time
`ddfb075f6b359d1e…` TAG-144’s Persistent Grip on South American Organizations	B3 #21	36m 28s
`764d71dadafd4fce…` GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and	B2 #16	23m 46s
`390181c309be9d69…` Page 2 / 37	B1 #25	23m 37s
`fb0660fd39456cb8…` TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base	B3 #32	23m 19s
`92b71dd407e51409…` Investigating Iranian Intrusion into Strategic	B2 #28	21m 43s
`c0b6b55f4177ff96…` Page 2 / 60	B3 #9	20m 48s
`6e059a147c076509…` BADBAZAAR and MOONSHINE: Technical analysis and mitigations	B2 #11	16m 03s
`8e8f1aed70127e49…` Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and Targeting	B2 #25	14m 15s
`485ca080f5d6a75a…` SPECIAL REPORT: MANDIANT M-TRENDS 2023	B1 #30	14m 07s
`76f60b9eb3b65739…` From espionage to PsyOps: Tracking operations and bulletproof	B2 #18	12m 13s

Ten reports with the most candidates

Report	Batch	Candidates
`ddfb075f6b359d1e…` TAG-144’s Persistent Grip on South American Organizations	B3 #21	829
`fb0660fd39456cb8…` TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base	B3 #32	533
`764d71dadafd4fce…` GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and	B2 #16	508
`92b71dd407e51409…` Investigating Iranian Intrusion into Strategic	B2 #28	498
`c0b6b55f4177ff96…` Page 2 / 60	B3 #9	485
`390181c309be9d69…` Page 2 / 37	B1 #25	449
`485ca080f5d6a75a…` SPECIAL REPORT: MANDIANT M-TRENDS 2023	B1 #30	381
`6e059a147c076509…` BADBAZAAR and MOONSHINE: Technical analysis and mitigations	B2 #11	368
`8e8f1aed70127e49…` Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and Targeting	B2 #25	308
`76f60b9eb3b65739…` From espionage to PsyOps: Tracking operations and bulletproof	B2 #18	271

Time per report tracks candidate count, because candidates go to the LLM in groups of 5. The ten slowest reports account for 42% of total extraction time. 1 report(s) had no candidates at all and finished in seconds without an LLM call.

Repeatability against ex3: 88 of 103 reports finished within 5 seconds of their ex3 time, and the largest difference was 67.8s. This fits deterministic (temperature: 0) inference on the same model and hardware.

What was stored

Indicators by type

Type	Indicators	Share	Avg quality	Avg confidence
`domain`	1,714	28.9%	58.2	41.5
`ipv4`	1,197	20.2%	58.8	78.8
`sha256`	1,154	19.4%	55.6	82.2
`url`	687	11.6%	54.4	22.0
`filename`	491	8.3%	54.3	55.0
`filepath`	335	5.6%	52.7	36.7
`email_address`	104	1.8%	54.5	34.7
`md5`	103	1.7%	53.7	81.6
`sha1`	65	1.1%	52.0	73.6
`mutex`	26	0.4%	58.6	35.3
`port`	22	0.4%	58.5	62.2
`registry_key`	17	0.3%	54.2	39.3
`hostname`	11	0.2%	58.4	83.9
`attachment`	4	0.1%	57.5	21.3
`process`	4	0.1%	50.2	41.5
`user_agent`	4	0.1%	52.5	0.0
`ipv6`	1	0.0%	67.0	85.0

Quality flags raised

Flag	Severity	Count
`verifier_rejected`	warning	1,161
`benign_observable`	warning	615
`self_reference`	warning	111
`known_benign`	warning	52
`truncated_span`	info	23
`technique_idiom`	warning	7
`non_routable`	warning	6
`verifier_uncertain`	info	1

Quality score distribution

Mean 56.5. Scored with the default weights; see Quality weights under Run configuration.

Score band	Indicators
80–100	1
60–79	3,195
40–59	2,325
20–39	418
0–19	0

Comparison with earlier runs

Database	Sources	Indicators	Sightings	Quality flags
ex2	103	5,939	6,239	1,986
ex3	103	5,939	6,239	1,976
ex4	103	5,939	6,239	1,976

ex3 and ex4 match on every headline count. ex2 has the same indicators and sightings but +10 quality flags. The row-level comparison in the LLM Analysis Deviation Report traces this to differences between pipeline builds: LLM verdicts on 13 entries, plus confidences, context fields and flags that follow from them.

Source files

Logs: ex4_batch1.log, ex4_batch2.log, ex4_batch3.log (repo root). This run was started without -v, so the logs hold per-report summaries but not per-LLM-call detail.
Database: db/ex4_threatlens.db (SQLite integrity check: ok)
Comparison timings: ex3_batch1.log, ex3_batch2.log, ex3_batch3.log, ex3_batch3_resume.log