CrossLink

CrossLink is a unified search-and-analysis interface for threat analysts running cyber investigations, used by several agencies and companies to collaborate on and further their work. As product owner and technical lead, it was my core focus at Qintel.

If you are familiar with cybersecurity, you probably know that there are a wide variety of data types used for analysis. These include whois records, pDNS records, account registrations, communications, exposed credentials, netflow data and more. Cases usually involve finding a trail by combining these different entities left by a criminal actor into a more cohesive picture.

An investigation typically starts with a selector or indicator of compromise. For example, you might see a malicious domain being used. In CrossLink, you could search that domain to find the whois and pDNS records associated with it. The whois records might give you an email or name if they weren’t privacy-protected. The pDNS records could lead you to more domains registered by the same actor which you could pivot on for more whois information. You might also see an actor discussing that domain in their communications. Once you’ve obtained an email or domain that you’re confident in, you start looking for the actor’s account registrations which will likely have more solid attribution information.

Along the way, you would build an investigation by saving every entity that seems linked to your initial selector. Within the investigation, you have the ability to revisit entities, see high-level summaries of everything it contains, add additional external links and selectors, or export everything.

It was a chance to go from zero to one on a lot of fronts at once — product, design, build, and team. We went through 4 major iterations of the API and GUI while I was on board and cut countless releases in between, taking it from a simple ReSTful API to a fairly advanced API and GUI used both internally and externally. I owned the ui/ux design and front-end architecture, set priorities with stakeholders, and coordinated with the core developers on fixes and features.

Due to the sensitive nature of the application, I can’t share too much in terms of screenshots.