cyberbrief

Active

A pile of threat data and a two-hour deadline to turn it into something a director will actually read. CyberBRIEF turns URLs, pasted text, and PDFs into an executive-grade BLUF report with MITRE ATT&CK mapping, extracted IOCs, TLP banners, and Chicago citations, all in one exportable package.

GitHub repo →
$git clone https://github.com/lidless-labs/cyberbrief.git && cd cyberbrief
web appMITRE ATT&CKself-hostedPython 3.10+ / Node

What it does

CyberBRIEF is a self-hosted web app that transforms raw threat data into structured cyber threat intelligence reports: a BLUF executive summary, MITRE ATT&CK technique mapping with Navigator layer export, automatically parsed IOCs (IPs, domains, hashes, CVEs, URLs), threat-actor profiles with confidence assessments, TLP classification, and academic citations. It exists because the alternative is a generic chatbot session that loses report structure, source provenance, and ATT&CK coverage the moment you copy the answer out. Unlike that workflow, CyberBRIEF keeps everything in one exportable Markdown or HTML package and lets you pick the research depth: Free (Brave Search + Gemini Flash, no API cost), Standard (Perplexity Sonar), or Deep (Perplexity Deep Research). The frontend is React 18 + TypeScript + Vite with Zustand state, the backend is a FastAPI service on Python 3.10+, and reports persist to SQLite.

CapabilitiesWhat it produces

Three research tiers

3 tiers

Free (Brave + Gemini Flash), Standard (Perplexity Sonar), and Deep (Perplexity Deep Research).

BLUF reports

Bottom-Line-Up-Front executive summaries that lead with the conclusion, with TLP banners on every report.

MITRE ATT&CK mapping

Automatic technique identification with ATT&CK Navigator layer export.

IOC extraction

5 types

IPs, domains, file hashes, CVEs, and URLs parsed automatically from sources.

Threat-actor profiling

Rich actor profiles with confidence assessments and Chicago Notes-Bibliography citations.

Flexible input & export

Feed URLs, raw text, or PDFs; export finished reports to Markdown or HTML.

Full tool reference on GitHub →

Setup

01 · install
git clone https://github.com/lidless-labs/cyberbrief.git && cd cyberbrief
02 · configure

Set API keys for Brave Search, Gemini, and Perplexity per docs/CONFIGURATION.md; the Free tier runs on Brave + Gemini Flash keys only.

03 · run from source
# backend
pip install -r backend/requirements.txt
(cd backend && uvicorn main:app --reload --port 8000)

# frontend -> http://localhost:5188
cd frontend && npm install && npm run dev

More in Threat Intelligence & OSINT3 tools

maltego-mcpLet your agent author Maltego .mtgx graphs and run whois, DNS, ASN, and crt.sh lookups. intel-workbenchBrowser-native ACH workbench: ATT&CK tagging, ICD 203 confidence, local-only. vervetThreat hunting for Zeek and Suricata logs: explainable per-host risk with ATT&CK evidence chains.