# Install threatdeck with Homebrew TUI threat intelligence monitoring and alerting platform. Version 0.6.0 via Homebrew; verified 2026-06-14. ## Install ```sh sudo av install brew:threatdeck ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install threatdeck ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:threatdeck - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.6.0 - **Source summary:** TUI threat intelligence monitoring and alerting platform - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** MIT - **Source archive:** - **Last updated:** 2026-06-14T11:02:48Z - **Generated:** 2026-07-25T07:20:51+00:00 ## Executables - ThreatDeck (cli) - ThreatDeck (alias) ## Dependencies - openssl@4 ## Build dependencies - pkgconf - rust ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-25 - Package-manager version: 0.6.0 - Package-manager updated: 2026-06-14 - Local data: ok - Upstream repository: https://github.com/gripebomb/ThreatDeck - Upstream latest detected: v0.6.0 (current) ## Project history and usage ThreatDeck is a terminal-based threat-intelligence monitoring and alerting platform for SOCs, security researchers, and threat-intelligence analysts. Its README presents it as a TUI for feeds, alerts, cached articles, indicators, enrichment queues, keywords, tags, logs, and settings. ### Project history The project is a Rust application built around a local SQLite database and a terminal UI. The README describes feed ingestion from APIs, RSS and Atom feeds, websites, and onion services, with alert generation, deduplication, IOC extraction, local enrichment, notification channels, and dashboard views. ### Adoption history ThreatDeck appears to be a newer and smaller package than the long-running security CLIs in this batch: the official GitHub page shows a modest star/fork count and a short repository history. Its packaging path is still meaningful because the README documents Cargo installation, source builds, a Homebrew package in the assigned facts, and first-run creation of config and data directories. ### How it is used Users launch `ThreatDeck`, add feeds, define keyword or regex alerts with criticality levels, browse and triage alerts in the terminal, and optionally configure enrichment providers. The default config file is `~/.config/ThreatDeck/config.toml`; the README documents the data database path and a `--config-paths` command for exact paths. ### Why package nerds care For package nerds, ThreatDeck is interesting as a packaged security TUI: it combines Rust, bundled SQLite, terminal UI dependencies, scheduled feed polling, JSONPath templates, optional Tor/onion access, and local enrichment into a single installable binary. ### Timeline - Current README: documents Cargo install, source build, first-run config/data paths, feed management, alerts, IOC enrichment, notifications, and SQLite storage. - Current repository page: shows a small public repository with README, docs, dist artifacts, and Rust source. ### Related projects - Related tools include RSS/API feed monitors, SOC alert triage dashboards, threat-intelligence platforms, IOC enrichment tools, terminal UI applications, and local SQLite-backed monitoring utilities. ### Sources - - ## Security Notes No matching local secret-handling manifest was found for threatdeck. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ~/.config/ThreatDeck/config.toml ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** threatdeck - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [openssl@4](https://www.automicvault.com/pkg/brew/openssl-4/) - Runtime dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [rust](https://www.automicvault.com/pkg/brew/rust/) - Build dependency declared by Homebrew. - [auditbeat](https://www.automicvault.com/pkg/brew/auditbeat/) - Shares av.db curated category or tags: cli, monitoring, security. - [logcheck](https://www.automicvault.com/pkg/brew/logcheck/) - Shares av.db curated category or tags: cli, monitoring, security. - [dnstwist](https://www.automicvault.com/pkg/brew/dnstwist/) - Shares av.db curated category or tags: cli, osint, security, threat-intelligence. - [aide](https://www.automicvault.com/pkg/brew/aide/) - Shares av.db curated category or tags: cli, monitoring, security. - [amass](https://www.automicvault.com/pkg/brew/amass/) - Shares av.db curated category or tags: cli, osint, security. - [bbot](https://www.automicvault.com/pkg/brew/bbot/) - Shares av.db curated category or tags: cli, osint, security. - [favirecon](https://www.automicvault.com/pkg/brew/favirecon/) - Shares av.db curated category or tags: cli, osint, security. - [iocextract](https://www.automicvault.com/pkg/brew/iocextract/) - Shares av.db curated category or tags: cli, security, threat-intelligence. ## Combined YAML source View the package source record on GitHub. [combined/threatdeck.yml](https://github.com/automic-vault/db/blob/main/combined/threatdeck.yml) ## Sources - Nucleus package database - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph