How fareedfauzi/mantis works
MANTIS is a local-first threat-intelligence workbench. An analyst searches an IOC or starts a workbench in the frontend; the backend routes the request to enrichment, local intelligence, or analysis services, and MANTIS AI can use collected evidence to support investigations and reporting. The graph preserves the README’s major workbench and monitoring branches. Edges cite the README or shown import/reference evidence; dashed links mark relationships whose implementation was not sampled.
Main entry points: main.py API routes · cti_query.py CTI articles · ai_service.py AI investigations · registry.py Agent tools
Components 29
Analyst experience
- MANTIS interface
frontend/app.js - AI panel
frontend/ai.js - Binary Lab UI
frontend/binary-lab.js - Infra Hunt UI
frontend/infra-hunt.js - Similarity UI
frontend/similarity.js - API routes
backend/main.py
IOC and investigations
- IOC enrichment
backend/intel_query.py - Infrastructure hunting
backend/infra_hunt_service.py - AI investigations
backend/ai_service.py - Evidence cases
backend/ai_case_service.py - Agent tools
backend/agent_tools/registry.py
Threat knowledge
- CTI articles
backend/cti_query.py - CTI corpus
backend/cti_db.py - MISP knowledge
backend/misp_galaxy.py
Malware workbenches
- Binary analysis
backend/binary_lab.py - Headless analysis
backend/omni_idb/runner.py - IDA investigation
backend/omni_runtime/genesect/handlers.py - Sample similarity
backend/similarity_service.py - YARA operations
backend/yara_service.py - YARA engine
backend/yara_engine.py
Collection and monitoring
- Breach monitoring
backend/breach_watcher.py - CTI feed intake
backend/feed_intel.py - Ransomware monitor
backend/ransomware_monitor.py - Telegram toolkit
backend/tg_channel_monitor.py - X monitoring
backend/x_monitor.py - Daily intelligence
backend/todays_intelligence.py
Other components
- Analyst
- Intel providers
- Local intelligence
Connections 37
- Analyst → MANTIS interface: uses
- MANTIS interface → API routes: submits searches
- AI panel → API routes: requests AI
- Binary Lab UI → API routes: opens workbench
- Infra Hunt UI → API routes: starts hunts
- Similarity UI → API routes: compares samples
- API routes → IOC enrichment: routes enrichment
backend/main.py - API routes → AI investigations: routes AI
backend/main.py - API routes → Evidence cases: runs cases
backend/main.py - API routes → Agent tools: mounts routes
backend/main.py - API routes → Infrastructure hunting: routes hunts
backend/main.py - API routes → Binary analysis: routes analysis
backend/main.py - API routes → Sample similarity: routes comparisons
backend/main.py - API routes → YARA operations: routes YARA
backend/main.py - API routes → CTI articles: routes article search
backend/main.py - CTI articles → CTI corpus: queries corpus
backend/cti_query.py - API routes → MISP knowledge: serves knowledge
backend/main.py - AI investigations → IOC enrichment: uses enrichment
backend/ai_service.py - AI investigations → CTI articles: uses article search
backend/ai_service.py - AI investigations → MISP knowledge: uses threat knowledge
backend/ai_service.py - Agent tools → IOC enrichment: looks up indicators
backend/agent_tools/registry.py - Agent tools → CTI articles: extracts article IOCs
backend/agent_tools/registry.py - Agent tools → Evidence cases: uses case tools
backend/agent_tools/registry.py - YARA operations → YARA engine: compiles and scans
backend/yara_service.py - Binary analysis → Headless analysis: runs analysis
- Headless analysis → IDA investigation: uses IDA tools
- Headless analysis → Local intelligence: writes reports
backend/omni_idb/runner.py - IOC enrichment → Intel providers: queries sources
- Infrastructure hunting → Intel providers: cross-references
- CTI feed intake → CTI corpus: feeds corpus
- API routes → Breach monitoring: serves monitoring
backend/main.py - API routes → Ransomware monitor: serves monitoring
backend/main.py - API routes → Telegram toolkit: serves toolkit
backend/main.py - API routes → X monitoring: serves monitoring
backend/main.py - API routes → Daily intelligence: serves rollup
backend/main.py - Daily intelligence → CTI articles: includes articles
- Daily intelligence → Breach monitoring: includes signals