THEORY

Multi-source threat actor intelligence for everyone. Generate analyst-grade dossiers from MITRE ATT&CK, Malpedia, OTX, SigmaHQ, ThreatFox, CISA, and vendor research blogs.

View on GitHub Quick Start
# generate a full dossier
$ theory --actor APT28 --sources mitre,malpedia,otx,sigma,threatfox

# export ATT&CK Navigator layer
$ theory --actor "Lazarus Group" --output navigator

# IR playbook with sector context
$ theory --actor APT29 --output playbook --sector finance

# STIX 2.1 bundle for MISP / OpenCTI / Sentinel
$ theory --actor Turla --output stix

# any alias works — 35 actors, 275 aliases
$ theory --actor "Fancy Bear" # → APT28
$ theory --actor "Cozy Bear" # → APT29
$ theory --actor "Volt Typhoon" # → Volt Typhoon
Output Formats

Nine ways to use the intelligence

Every dossier opens with an LLM-synthesized executive overview. Export to whatever your workflow needs.

--output dossier
Terminal + Markdown
Rich terminal output with a saved markdown file. The default.
--output html
HTML Dossier
Self-contained, shareable intelligence report. Opens in any browser, works offline.
--output navigator
ATT&CK Navigator
Confidence-colored heatmap layer. Import directly into MITRE Navigator.
--output playbook
IR Playbook
Detection checklists, IOC blocks, hunt hypotheses, containment steps. Markdown or Jira.
--output stix
STIX 2.1 Bundle
Import into MISP, OpenCTI, Splunk ES, or Microsoft Sentinel.
--output json
JSON Profile
Raw unified profile. Build your own integrations.
--output csv
IOC CSV
Raw indicator values for SIEM lookup tables and blocklists.
--output exec
Executive Summary
Non-technical BLUF briefing with sector context. Hand it to leadership.
--detection-path
Coverage Gap Report
Compare actor TTPs against your local detection rules. Find what you're missing.
Intelligence Sources

Seven sources, one unified profile

Each source feeds into a common schema. The deduplicator merges everything and assigns confidence scores. Nothing downstream knows which source the data came from.

Source Key Auth Cache
MITRE ATT&CK mitre none 7 days
CISA Advisories + KEV cisa none per request
Malpedia malpedia none per request
AlienVault OTX otx OTX_API_KEY per request
SigmaHQ detection rules sigma none 7 days
ThreatFox IOCs threatfox none 24 hours
Vendor intel synthesis vendor LLM API key 7 days
Quick Start

Running in under a minute

Python 3.11+, a virtual environment, and one free API key. That's it.

# clone and install
git clone https://github.com/threatcraft-co/theory
cd theory && python -m venv venv && source venv/bin/activate
pip install -e .

# download the ATT&CK bundle
theory --update-bundles

# configure API keys (OTX is free at otx.alienvault.com)
cp .env.example .env

# run your first dossier
theory --actor APT28