Ninja Social — the collaboration manual
Social is real-time team collaboration for threat intelligence — a Slack-style app with channels, direct messages, presence, and a live threat-intel feed. It auto-detects IOCs in what you type and enriches them from Signal. This manual covers the channels, the feed, DMs and how enrichment works.
What Social is
Where the team works threat intel together: real-time messaging over WebSockets, presence and typing indicators, direct messages, and a live feed of threat-intel events. Messages aren't just chat — Social scans them for indicators and pulls context from the Signal graph automatically.
Channels
Home lands you in General. Standing topic channels keep the work organised: Threat Intel, Incidents (incident response), Detections (detection engineering), SITREP and Alerts. Join a channel and its history and membership live in the graph.
Live Feed
A real-time stream of threat-intel events pushed from the ecosystem message bus (NATS). The feed is the ambient awareness layer — new detections, alerts and intel scroll in as they happen, next to the conversation about them.
Direct messages & presence
One-to-one messaging alongside the channels, with presence and typing indicators (Redis-backed) so you can see who's around and who's replying.
Automatic IOC enrichment
The differentiator: as you post, Social detects indicators of compromise in the text and enriches them from the Signal API automatically — so a hash or IP dropped in chat comes back with context from the threat graph, without leaving the conversation.
Access & sign-in
Sign in through the ecosystem (Signal SSO); a JWT session cookie gates every page and the API. Social's social graph and message history persist in Neo4j.