intel-workbench

Active

When you already favor a suspect, every new indicator reads like confirmation and the analysis quietly becomes a defense of your first guess. Intel Workbench runs Analysis of Competing Hypotheses in the browser: score each piece of evidence against every hypothesis, let inconsistency (not agreement) pick the winner, and tag it all to MITRE ATT&CK before you write the estimate.

GitHub repo →
$git clone https://github.com/lidless-labs/intel-workbench.git && cd intel-workbench && npm install && npm run dev
ACH matrix12-bias checklistICD 203 bandsoffline-firstno backend

What it does

Intel Workbench is an offline-first browser workbench that puts the Analysis of Competing Hypotheses structured analytic technique in front of a CTI analyst: an evidence-vs-hypothesis matrix where each cell is rated Consistent, Inconsistent, Neutral, or Not Applicable, and the hypothesis with the fewest weighted inconsistencies is flagged as preferred. It exists because the discipline that separates real intelligence work from a hunch, disprove rather than prove, plus explicit bias review and calibrated estimative language, usually lives in a PDF primer instead of the tool you actually work in. It differs from a note-taking or ticketing setup by being a single-page React app with no backend at all: state persists to localStorage under intel-workbench-projects, MITRE ATT&CK is vendored locally so tagging works with the network off, and a finished assessment exports to JSON for backup or Markdown for the report, with ATT&CK technique IDs carried through.

CapabilitiesThe analyst's desk, in five parts

ACH matrix & scoring

core

Interactive evidence-vs-hypothesis grid with C/I/N/NA ratings, weighted inconsistency scoring, and automatic preferred-hypothesis identification (lowest score wins).

MITRE ATT&CK tagging

691 techniques

Tag evidence and hypotheses against the vendored Enterprise matrix (691 techniques, 14 tactics); search by ID, name, or tactic, offline.

Cognitive bias checklist

12 biases

Heuer & Pherson taxonomy across Cognitive, Analytical, and Social categories with per-bias mitigation notes.

Estimative language & weighting

ICD 203

Pick a likelihood band from 'almost no chance' to 'almost certainly' with canonical ODNI ranges; credibility and relevance ratings (High/Medium/Low) feed the weighted scores.

Export & onboarding

JSON / Markdown

Full JSON export/import for backup and sharing, Markdown export with ATT&CK IDs for reports, plus a driver.js guided tour and in-app methodology docs.

Full tool reference on GitHub →

Setup

01 · install
git clone https://github.com/lidless-labs/intel-workbench.git && cd intel-workbench && npm install && npm run dev
02 · configure

Node.js 18+ and npm 9+. No backend, no API keys; the dev server runs at http://localhost:5173. A hosted build is live at intel-workbench.vercel.app.

03 · production build
npm run build && npm run preview

Safety

how it stays safe
Offline-first and backend-free by design: all project state lives in browser localStorage under intel-workbench-projects and never leaves the machine, the MITRE ATT&CK dataset is vendored locally rather than fetched at runtime, and export/import is the only data movement, on explicit user action.

More in Threat Intelligence & OSINT3 tools

maltego-mcpLet your agent author Maltego .mtgx graphs and run whois, DNS, ASN, and crt.sh lookups. cyberbriefAI threat-intel briefings: BLUF reports, ATT&CK mapping, and IOC extraction. vervetThreat hunting for Zeek and Suricata logs: explainable per-host risk with ATT&CK evidence chains.