Threat posture overview
Latest 250 incidents · auto-refreshes every 30s
Threat posture at a glance
Risk concentration
Critical incident share from the last seven days.
Channel pressure
Busiest attack path surfaces here.
7-day trend
Recent incidents
Threat investigation workspace
Scan suspicious content · Standard or AI pipeline
Executive summary
Run an assessment to generate an incident summary.
Recommended response
Response guidance will appear here after a scan.
Threat story
Threat narrative is built from evidence after each scan.
Investigation timeline
Evidence signals
Indicators
AI trace
AI explanation
Enable AI mode for deeper narrative context.
AI pipeline
standard-only · N/A
Case controls
AI settings
No provider settings saved.
Analytics
Signal breakdown, channel mix, and feedback quality
Incident mix
Validates once analysts mark incident outcomes.
Threat categories & patterns
Feedback quality
Channel summary
Recent threat cards
Repeated signals & channels
Most repeated detection reasons.
Channel concentration.
Rule manager
Govern live detection logic without redeployment
Access
Create rule
Rule guidance
Extensions
Client integrations for Gmail, Outlook, and Thunderbird
Scans open Gmail messages automatically. Overlays a verdict badge inline with every email and provides detailed threat context in the popup.
No native add-in yet. Use dashboard paste for quick scans, or install the OWA bookmarklet for one-click scanning directly in Outlook Web.
No add-on yet. Copy email text or raw headers (Ctrl+U) and paste into the Scan tab for full ML + AI analysis.
Step-by-step setup
Click Download ZIP above. Extract it anywhere — the chrome-extension/ folder is what you need.
Navigate to chrome://extensions or go to Menu → More tools → Extensions.
Toggle Developer mode in the top-right corner. This allows loading unpacked extensions.
Click Load unpacked and select the chrome-extension/ folder. The ThreatWatch AI for Gmail card will appear.
Go to mail.google.com, open any email — ThreatWatch AI scans it automatically and shows the verdict inline. The API URL is pre-set to this server.
Direct API access
curl -X POST ${location.origin}/api/v1/scan \
-H "X-API-Key: <your-key>" \
-H "Content-Type: application/json" \
-d '{"subject":"Urgent: verify your account","body":"Click here...","mode":"ai"}'