The Master Blueprint

From Noise to Knowledge

The internet is noisy. Every day: 60+ new CVEs published. Hundreds of IOC feeds updated. Geopolitical events shift threat actor priorities. Social media amplifies disinformation. Economic indicators correlate with ransomware surges. All of it is data. Almost none of it is intelligence — until something connects it.

The ninja.ing ecosystem exists to make that connection. Not through dashboards bolted together with REST APIs, but through a unified knowledge graph where a vulnerability node connects to the technique that exploits it, connects to the actor that uses it, connects to the campaign that deployed it, connects to the geopolitical event that motivated it.

Two platforms sit at the centre of this. Signal handles cyber threat intelligence — the adversaries, their tools, their techniques, and the indicators they leave behind. Fusion handles everything else — geopolitics, economics, social intelligence, environmental data, military movements — and fuses it with Signal's cyber picture.

The Intelligence Pipeline

Every piece of intelligence follows the same path, regardless of source:

The critical insight: Claims are the universal adapter. Any feed, any format — whether it's a JSON blob from the NVD, a STIX bundle from MITRE, a CSV from CISA, or a GDELT event stream — gets decomposed into atomic subject/predicate/object triples. A Claim says: "this thing has this relationship to that thing, and here's where I learned it."

Signal: The Cyber Layer

20 ingesters pull from the core CTI feeds. NVD for vulnerabilities. MITRE ATT&CK for techniques and threat actors. OTX for IOCs. CISA KEV for known exploited vulnerabilities. Abuse.ch suite (MalwareBazaar, ThreatFox, Feodo, URLhaus) for malware samples and C2 infrastructure. GitHub Advisories. Phishing feeds. Ransomware trackers. CIRCL for intelligence sharing. OpenCTI for STIX import.

Signal's graph holds ~1M nodes across 14 labels: 89K+ indicators, 48K+ software entries, 21K+ infrastructure nodes, 1,900+ vulnerabilities, 1,200+ techniques, 245+ threat actors, and 40+ campaigns. All connected by edges that encode how the threat landscape actually works.

Fusion: The Everything Layer

84 ingesters across eight domains. Not just cyber — geopolitical events (GDELT, ACLED, GTD), economic indicators (FRED, IMF, World Bank), social intelligence (Reddit, Twitter, Mastodon, Telegram, Bluesky), environmental data (NASA FIRMS, GDACS, EMDAT), military and sanctions data (SIPRI, OFAC SDN, OpenSanctions), health (WHO), and technology (Shodan, OpenSky, AIS maritime).

Why does a threat intelligence platform need economic data? Because ransomware surges correlate with cryptocurrency prices. Because sanctions drive state-sponsored actors to find new funding. Because a geopolitical crisis in one region predicts cyber campaigns against targets in another. Fusion makes those connections visible.

The Claims Engine

Every ingester, every source, every feed — they all produce the same thing: Claims. A Claim is the atomic unit of intelligence. It's a frozen, immutable dataclass that says: "Subject X has Predicate relationship to Object Y, sourced from Z with confidence C."

The Claim Dataclass

14 fields. Frozen. Immutable. Two Claims from different sources about the same fact will merge into a single graph edge, preserving the earliest first_seen and updating last_seen. Provenance is never lost — the source_name, source_url, and confidence travel with every assertion.

Graph Merge Strategy

Claims don't INSERT into the graph. They MERGE. The ingestion engine batches Claims in groups of 500, groups them by schema pattern (subject_type, predicate, object_type), and fires a single UNWIND Cypher query per group:

Deadlock retry with exponential backoff: 3 attempts, sleeping 2× the attempt number in seconds. Non-deadlock errors fail immediately. This handles Neo4j's transaction contention when multiple ingesters run concurrently.

Node Labels

Signal uses 14 node labels. Each represents a first-class entity in the threat intelligence domain:

Relationship Types

Edges are typed. Each encodes a specific semantic relationship:

Fusion’s Extended Schema

Fusion extends the schema with 20+ node labels to cover cross-domain entities: SocialPost, EconomicIndicator, GeopoliticalEvent, Country, Organization, SanctionedEntity, and more. Cross-domain edges connect a geopolitical crisis to the cyber campaigns it spawns, or an economic shock to the ransomware surge that follows.

Signal — Technical Architecture

Backend: adversary_graph_app.py

One FastAPI application. 225 endpoints — 151 GET, 62 POST, 5 PATCH, 4 DELETE, 3 WebSocket. Organised by domain: graph queries, ML analytics, twins (digital adversary profiles), threat attribution, KQL generation, process mining, causal inference, semantic search, geospatial analysis, CTI extraction, briefing generation, and more.

Key design decision: one file, one process. No microservices splitting. The intelligence domain is deeply interconnected — a risk scoring endpoint needs access to the graph, the ML cache, the twin profiles, and the semantic index. Splitting that into services would add network hops and serialisation overhead for zero architectural benefit.

Core Modules

Signal ships with 32 Python modules in core/. Each handles a distinct analytical capability:

Frontend: 37 Floating Windows

Signal's UI is a Next.js 16 / React 19 application with a custom window manager. Not tabs. Not pages. Floating, draggable, resizable windows — like a desktop OS for threat intelligence. The user can arrange graph views, ML dashboards, twin profiles, and causal analysis side by side.

Auth Model

File-based JSON user store. Passwords hashed with bcrypt. JWTs signed with jose. Middleware enforcement in middleware.ts — every route is protected except explicit public paths. MFA gate available. Role-based admin access. SSO token exchange for cross-app authentication.

Sample API Endpoints

Fusion — Technical Architecture

Backend: fusion_app.py

FastAPI with 107 endpoints. Where Signal is deep on cyber, Fusion is wide across domains. The same Claims engine, the same graph store, but pointing at a much broader universe of data — and a set of analytical modules designed to find the connections between domains that no single-domain tool would ever surface.

84 Ingesters Across 8 Domains

Core Modules

15 modules in core/, with analytical capabilities tuned for cross-domain fusion:

Narrative Clustering

Fusion's signature analytical capability. narrative.py ingests social posts from all platforms, vectorises them with TF-IDF (5,000 features, bigram support), clusters with DBSCAN, and runs coordination scoring to detect information operations. An LLM labels each cluster's theme, then the engine compares narratives against GDELT ground-truth events for a reality divergence score — how far is the online narrative drifting from what's actually happening?

Security Scanner

Built-in web scanner orchestrating Nuclei (template-based vulnerability scanning), testssl.sh (TLS assessment), and httpx (HTTP probing). Findings write back to the graph as SecurityFinding nodes linked to Domain and Vulnerability nodes. Single-scan queueing with thread-safe locking and cancellation support.

Frontend: Cross-Domain Dashboard

Next.js 16 / React 19 with a different approach to Signal's window manager. Fusion uses an AppShell with sidebar navigation — globe view, threat dashboard, social intelligence, narrative analysis, DataLab, scanner, twins, forecasting. Day/night mode toggle (warm paper palette in day, dark stealth in night). No server-side middleware — auth is handled client-side via the AppShell component.

Sample API Endpoints

The Stealth Stack

Container Topology

Each app follows the same Docker Compose pattern: Neo4j 5 + FastAPI backend + Next.js frontend. Signal adds Caddy (reverse proxy for all domains) and NATS (event bus). Some apps add Redis for real-time features.

Caddy Routing

One Caddy instance in Signal's Docker Compose handles HTTPS termination for all 11 production domains. The routing logic is subtle and ordering matters:

Critical detail: New Next.js API routes must be added to the Caddy config before the handle_path /api/* catch-all, or they'll be incorrectly routed to the Python backend.

Security Shield

All 11 domains import a shared Caddy (security_shield) snippet:

fail2ban

Three jails watching Caddy access logs:

Network Architecture

All apps run on a single Hetzner dedicated server. Non-RTM containers join RTM's Docker network (rapid-threat-modeler_default) to access the shared Caddy proxy. Each app has its own Neo4j instance on a unique Bolt port. In production, Neo4j and API ports are not exposed to the host — only Caddy's 443 is public.

Deployment Pattern

Every deploy follows the same sequence. No CI/CD pipeline — deliberate simplicity:

The Full Arsenal

15 systems. One SSO. One event bus. One graph mindset. Each built for a specific intelligence domain, all designed to share context through the graph and NATS.

SSO: One Identity Everywhere

Every app implements the same SSO handshake. When a user is authenticated in Signal and clicks through to Fusion, the flow is:

Each app has its own cookie name to avoid conflicts. The JWT payload is verified server-side. No shared session store — just cryptographic trust.

NATS Event Bus

JetStream provides durable, at-least-once delivery across all apps. 9 subject hierarchies:

When Raz0r detects a suspicious process, it publishes to razor.alert. V0id agents subscribe and auto-triage. Signal enriches the IOC. Fusion correlates with geopolitical context. All without any app knowing about the others — just messages on a bus.

Galaxy Visualization

Signal's /galaxy/data endpoint samples ~8,000 nodes from the ML graph, groups them by label, and computes a 3D radial cluster layout. V01d's ninjaTONE page renders this as a Three.js point cloud — a galaxy of threats you can fly through, click, and explore. It's not just pretty. It's the entire threat landscape in one view.

Subject to Change

This document describes the architecture as of March 2026. It will change. The ecosystem is alive — new ingesters, new ML modules, new analytical capabilities ship regularly. What won't change is the core philosophy: one graph, atomic claims, domain fusion.

The hardest problem in security isn't detection. It's connection. Every tool in this ecosystem exists to make one more connection visible — between an IOC and an actor, between an actor and a campaign, between a campaign and the geopolitical event that triggered it. When all those connections live in one graph, you stop reacting to alerts and start understanding adversaries.

The graph doesn't give you answers. It gives you the right questions — and the traversals to find them.