How ethan-andrews/threatintel-aggregator works
Threat Intel Aggregator is a self-hosted threat-intelligence platform: users review ingested security feeds, triaged articles and extracted indicators, and correlate threats with their environment. The main path runs from scheduled feed collection and triage through backend APIs to the dashboard. Separate product branches provide IOC and MITRE views, RunZero exposure, and detection review with Sentinel synchronization and tuning. The README documents capabilities whose internal wiring is not established by the sampled source; those are represented without speculative call chains.
Main entry points: main.py Backend API · db.py Application Database · feed_manager.py Feed Collection · orchestrator.py TI Detection Pipeline
Components 23
Threat Intelligence
- Feed Collection
backend/feed_manager.py - AI Triage
backend/feed_manager.py - Enrichment
backend/enrichment.py - IOC Ledger
backend/ioc_export.py - MITRE Coverage
backend/detection_pipeline/mitre_tactics.py
Environment Context
- RunZero Sync
backend/runzero_sync.py - Your Stack
backend/stack_presets.py - Exposure Tracking
backend/main.py
Detection Operations
- Detection Review
frontend/components/detections/DetectionsPanel.js - Coverage Ledger
backend/detection_pipeline/coverage_ledger.py - TI Detection Pipeline
backend/detection_pipeline/orchestrator.py - Sentinel Operations
backend/detection_pipeline/sentinel.py - Tuning Suggestions
backend/detection_pipeline/tuning_suggestions.py - Tuning Controls
frontend/components/detections/useTuningSuggestions.js
Application
- Dashboard
frontend/pages/index.js - Dashboard Filters
frontend/context/FilterContext.js - Backend API
backend/main.py - Application Database
backend/db.py
Other components
- Analyst
- Security Feeds
- RunZero Inventory
- detections.ai
- Microsoft Sentinel
Connections 25
- Analyst → Dashboard: uses
- Dashboard → Backend API: requests data
- Dashboard → Dashboard Filters: sets filters
- Security Feeds → Feed Collection: provides feeds
- Feed Collection → Security Feeds: fetches articles
- Feed Collection → AI Triage: triages entries
- Feed Collection → Application Database: stores entries
- AI Triage → Application Database: stores results
- AI Triage → Enrichment: enriches entries
- Backend API → Application Database: reads and writes
- Backend API → IOC Ledger: serves IOC export
- Backend API → MITRE Coverage: serves MITRE data
- Backend API → RunZero Sync: schedules sync
- RunZero Inventory → RunZero Sync: provides inventory
- RunZero Sync → Application Database: stores matches
- Backend API → Your Stack: serves stack settings
- Backend API → Exposure Tracking: serves exposure data
- Detection Review → Backend API: requests reviews
- Backend API → Coverage Ledger: uses coverage ledger
- TI Detection Pipeline → Application Database: reads outbox
- TI Detection Pipeline → detections.ai: submits intel
- TI Detection Pipeline → Sentinel Operations: syncs hunts
- Sentinel Operations → Microsoft Sentinel: queries and syncs
- Backend API → Tuning Suggestions: applies suggestions
- Tuning Controls → Backend API: posts actions