cyberbrief
ActiveA pile of threat data and a two-hour deadline to turn it into something a director will actually read. CyberBRIEF turns URLs, pasted text, and PDFs into an executive-grade BLUF report with MITRE ATT&CK mapping, extracted IOCs, TLP banners, and Chicago citations, all in one exportable package.
What it does
CyberBRIEF is a self-hosted web app that transforms raw threat data into structured cyber threat intelligence reports: a BLUF executive summary, MITRE ATT&CK technique mapping with Navigator layer export, automatically parsed IOCs (IPs, domains, hashes, CVEs, URLs), threat-actor profiles with confidence assessments, TLP classification, and academic citations. It exists because the alternative is a generic chatbot session that loses report structure, source provenance, and ATT&CK coverage the moment you copy the answer out. Unlike that workflow, CyberBRIEF keeps everything in one exportable Markdown or HTML package and lets you pick the research depth: Free (Brave Search + Gemini Flash, no API cost), Standard (Perplexity Sonar), or Deep (Perplexity Deep Research). The frontend is React 18 + TypeScript + Vite with Zustand state, the backend is a FastAPI service on Python 3.10+, and reports persist to SQLite.
Capabilities
What it produces
Set it up
Set API keys for Brave Search, Gemini, and Perplexity per docs/CONFIGURATION.md; the Free tier runs on Brave + Gemini Flash keys only.
Run from source
# backend pip install -r backend/requirements.txt (cd backend && uvicorn main:app --reload --port 8000) # frontend -> http://localhost:5188 cd frontend && npm install && npm run dev