live
Threat Intelligence Assistant
A retrieval-augmented threat intel assistant over MITRE ATT&CK and CISA KEV — grounded answers with citations, confidence scores, and hard abstention.
- Cybersecurity
- RAG
- Threat Intel
- MITRE
Overview
Threat Intelligence Assistant indexes 3,312 chunks across MITRE ATT&CK techniques, groups, software, and CISA KEV. It delivers grounded answers with mandatory citations, transparent confidence scoring, and hard abstention when evidence is weak. Dual local/cloud architecture (Ollama + FAISS / Groq + HuggingFace) ships a committed FAISS index so the public demo runs without Ollama or raw dataset downloads — with query scope filtering, entity-ID-aware retrieval, and citation validation.
Highlights
- RAG over 3,312 ATT&CK + CISA KEV chunks with mandatory citations
- Confidence scoring and hard abstention on weak evidence
- Entity-ID-aware retrieval for techniques, groups, and CVEs
- Dual local/cloud LLM architecture with committed FAISS index