Shield-IoT AI Threat Management is a network-based threat detection platform designed for Edge, IoT, and OT environments. It analyzes network traffic statistics (metadata) to detect known and unknown cyber-attacks and operational anomalies in real time. The platform includes four detection engines: 1. Coreset-AI Network Anomaly Detection – Uses patented Coreset-AI technology developed through research at MIT and Haifa University. It continuously learns normal device behavior and applies unsupervised machine learning algorithms to detect unknown threats without relying on signatures. 2. Agentic AI Security Expert – An LLM-driven analysis layer that transforms raw network logs into contextual event narratives. It identifies affected devices, highlights compliance gaps, and provides actionable recommendations for remediation and prevention. 3. Rule-based Engine – Detects known attacks and operational events using over 30 pre-built security rules and a user-configurable rule wizard that requires no coding expertise. 4. Threat Intelligence – Identifies communication with known malicious sites by combining internal Shield-IoT research with over 100 external threat intelligence feeds updated in real time. Detected threat types include unknown malware, DDoS, device takeover, IoT ransomware, communication hijacking, cloud hacking, data theft, SIM switch/abuse, and device malfunction. Each detected event includes forensic information: device ID, event type, severity, trigger parameters, links to raw PCAP/NetFlow files, and recommended actions. The platform targets large-scale deployments in sectors such as transportation, smart grids, smart cities, and payment networks.