CYBERSECURITY
Threat Intelligence Platform Database Schema
A worked cybersecurity example, rendered live. Open it in the AI editor and adapt it to your own case.
Make this diagram your own.
Open it in the AI editor with a prompt pre-filled — keep what works, change what doesn't.
CASE ANALYSIS
Scenario
Design a database for a cyber threat intelligence platform that aggregates IOCs from multiple feeds, associates them with threat actors, and tracks relationships between indicators.
Key decisions
- Normalizing indicator types into a separate table allows consistent querying.
- Using a junction table for many-to-many IOC-to-actor associations provides flexibility.
- Storing indicator-to-indicator relationships enables advanced threat hunting.
When to reuse this
When building a threat intelligence platform, SIEM integration, or security analytics system that requires structured storage of IOCs and their context.
Open this example in the editor →
Tweak it with chat, export PNG/SVG, or fork it for your own use case.
erd-threat-intelligence-feed-schema-with-ioc-relationships