# Install threatdeck with Homebrew

TUI threat intelligence monitoring and alerting platform. Version 0.6.0 via Homebrew; verified 2026-06-14.

## Install

```sh
sudo av install brew:threatdeck
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install threatdeck
```

  Evidence: local Homebrew formula metadata

## Package facts

- **Package key:** brew:threatdeck
- **Package manager:** Homebrew
- **Version:** 0.6.0
- **Source summary:** TUI threat intelligence monitoring and alerting platform
- **Homepage:** <https://threatdeck.io/>
- **Repository:** <https://github.com/gripebomb/ThreatDeck>
- **Last updated:** 2026-06-14T11:02:48Z
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- ThreatDeck (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 0.6.0
## Project history and usage

ThreatDeck is a terminal-based threat-intelligence monitoring and alerting platform for SOCs, security researchers, and threat-intelligence analysts. Its README presents it as a TUI for feeds, alerts, cached articles, indicators, enrichment queues, keywords, tags, logs, and settings.

### Project history

The project is a Rust application built around a local SQLite database and a terminal UI. The README describes feed ingestion from APIs, RSS and Atom feeds, websites, and onion services, with alert generation, deduplication, IOC extraction, local enrichment, notification channels, and dashboard views.

### Adoption history

ThreatDeck appears to be a newer and smaller package than the long-running security CLIs in this batch: the official GitHub page shows a modest star/fork count and a short repository history. Its packaging path is still meaningful because the README documents Cargo installation, source builds, a Homebrew package in the assigned facts, and first-run creation of config and data directories.

### How it is used

Users launch `ThreatDeck`, add feeds, define keyword or regex alerts with criticality levels, browse and triage alerts in the terminal, and optionally configure enrichment providers. The default config file is `~/.config/ThreatDeck/config.toml`; the README documents the data database path and a `--config-paths` command for exact paths.

### Why package nerds care

For package nerds, ThreatDeck is interesting as a packaged security TUI: it combines Rust, bundled SQLite, terminal UI dependencies, scheduled feed polling, JSONPath templates, optional Tor/onion access, and local enrichment into a single installable binary.

### Timeline

- Current README: documents Cargo install, source build, first-run config/data paths, feed management, alerts, IOC enrichment, notifications, and SQLite storage.
- Current repository page: shows a small public repository with README, docs, dist artifacts, and Rust source.

### Related projects

- Related tools include RSS/API feed monitors, SOC alert triage dashboards, threat-intelligence platforms, IOC enrichment tools, terminal UI applications, and local SQLite-backed monitoring utilities.

### Sources

- <https://github.com/gripebomb/ThreatDeck#readme - official README for purpose, features, install, config paths, feed types, enrichment, keyboard shortcuts, architecture, and development.>
- <https://threatdeck.io/ - official homepage listed in source_facts and current curation.>


## Security Notes

No matching local secret-handling manifest was found for threatdeck. Nucleus package metadata is still published here so future coverage has a stable package URL.



## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: ~/.config/ThreatDeck/config.toml

## Combined YAML source

View the package source record on GitHub. [combined/threatdeck.yml](https://github.com/mxcl/pkgdb/blob/main/combined/threatdeck.yml)


## Sources

- pkg.so package database
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- cross-ecosystem install command graph