intel-workbench
ActiveWhen you already favor a suspect, every new indicator reads like confirmation and the analysis quietly becomes a defense of your first guess. Intel Workbench runs Analysis of Competing Hypotheses in the browser: score each piece of evidence against every hypothesis, let inconsistency (not agreement) pick the winner, and tag it all to MITRE ATT&CK before you write the estimate.
What it does
Intel Workbench is an offline-first browser workbench that puts the Analysis of Competing Hypotheses structured analytic technique in front of a CTI analyst: an evidence-vs-hypothesis matrix where each cell is rated Consistent, Inconsistent, Neutral, or Not Applicable, and the hypothesis with the fewest weighted inconsistencies is flagged as preferred. It exists because the discipline that separates real intelligence work from a hunch, disprove rather than prove, plus explicit bias review and calibrated estimative language, usually lives in a PDF primer instead of the tool you actually work in. It differs from a note-taking or ticketing setup by being a single-page React app with no backend at all: state persists to localStorage under intel-workbench-projects, MITRE ATT&CK is vendored locally so tagging works with the network off, and a finished assessment exports to JSON for backup or Markdown for the report, with ATT&CK technique IDs carried through.
Capabilities
The analyst's desk, in five parts
Set it up
Node.js 18+ and npm 9+. No backend, no API keys; the dev server runs at http://localhost:5173. A hosted build is live at intel-workbench.vercel.app.
Production build
npm run build && npm run preview
Offline-first and backend-free by design: all project state lives in browser localStorage under intel-workbench-projects and never leaves the machine, the MITRE ATT&CK dataset is vendored locally rather than fetched at runtime, and export/import is the only data movement, on explicit user action.