ThreatMapper: I Built a Self-Hosted AI Threat Intelligence Platform — Here’s How to Use It

Map adversary behaviour to MITRE ATT&CK in seconds, compare against 160+ APT groups, and generate PDF reports — all running locally with your own LLM keys.

Table of Contents

9. Docs:



• API docs (Swagger UI):

  The sync downloads only the new bundle version and ingests it alongside the existing data without deleting anything. Both versions remain queryable — endpoints accept an optional ?version=19.1 parameter to target a specific release.

  Tips for Analysts

  Calibrate your confidence threshold. I recommend treating < 50% confidence as noise until you validate it manually. The LLM is trying hard to find ATT&CK mappings, which means it will sometimes stretch an inference. Use the evidence snippet to sanity-check every mapping.

  Use the Gap Analysis as a hunt checklist. When you match against an APT group in Compare, the Gap Analysis tab shows every technique in their known profile that you haven’t covered. This is an excellent input for a structured hunt — you’re essentially asking “what would we need to observe to confirm this attribution?”

  Chain features for maximum value. The best workflow is: AI Analysis → inject into Navigator → Compare against APT groups → Gap Analysis → export PDF. Each step builds on the last.

  Chat is good for detection rules. The AI assistant is particularly strong at generating SIGMA rules, KQL queries, and Splunk SPL from ATT&CK technique IDs. Give it the full ATT&CK technique description plus any specific context from your environment (OS, logging stack) and you’ll get useful starting points rather than generic templates.

  Import your existing layers. If your team already maintains ATT&CK Navigator layers for your environment (e.g. a “what we detect” layer and a “what we’ve seen” layer), import them via the ↑ Import button. ThreatMapper will let you compare them against APT profiles and run AI chat against the techniques in the layer.

  Save named layers as investigation checkpoints. After any significant piece of work — a completed AI analysis, a finished APT comparison session, a purple-team prep layer — click ↓ Save layer and give it a meaningful name. This takes 10 seconds and means you never lose work between sessions. You can reload any saved layer instantly from 📂 Load layer without re-running analysis.

  Use text paste for quick triage. You don’t need a formatted document. Paste raw Slack thread text, a SIEM alert body, or a vendor advisory into the text box. The AI is good at extracting signal from noisy, informal text.

  Security Considerations

  ThreatMapper is designed for internal/intranet use. It has no built-in authentication — anyone who can reach the Docker network can use it.

  For a team deployment:

  1. Set a strong DB_PASS in .env
  2. Put ThreatMapper behind nginx / Caddy with TLS and HTTP Basic Auth (or integrate with your identity provider via OAuth)
  3. Run the Docker containers on an internal network that is not directly internet-accessible
  4. The .env file containing your LLM API keys should have chmod 600 and never be committed to git

  Your threat intelligence reports are stored in PostgreSQL inside the Docker volume. If you need to comply with data handling policies, deploy ThreatMapper on infrastructure that meets those policies — since it’s self-hosted, you retain full control.

  What’s Coming Next

  The tool is functional but there is plenty of room to grow. Things I’m actively thinking about:

  • TAXII/STIX import — accept threat intelligence directly from TAXII feeds (MISP, OpenCTI, commercial CTI platforms)
  • Team collaboration — shared TTP layers with user namespacing
  • Detection coverage overlay — import your existing SIGMA rule library and visualise which ATT&CK techniques you have coverage for vs which are blind spots
  • Automatic APT tracking — when ATT&CK releases a new version that adds techniques to a group you’re tracking, send a notification

  Final Thoughts

  The core idea behind ThreatMapper is that the heavy lifting of ATT&CK mapping — reading a report, recognising a technique, looking it up, comparing it — is exactly the kind of repetitive, pattern-matching work that LLMs are well-suited for.

  The analyst’s judgement is still essential: deciding which mappings to trust, what the attribution implications are, what to do about the gap analysis. But the mechanical translation layer — text to ATT&CK IDs — should not take most of your time.

  ThreatMapper tries to handle that translation layer so you can spend your time on the interesting parts.

  The project is open source under the MIT licence. If you find it useful, have feature requests, or find bugs, open an issue on GitHub.

  GitHub: (after starting with docker compose up)

  ThreatMapper uses the MITRE ATT&CK® framework. ATT&CK is a registered trademark of The MITRE Corporation. This project is not affiliated with or endorsed by MITRE.

  Follow for practical cybersecurity research

  If you’re interested in Offensive security, AI security, real-world attack simulations, CTI, and detection engineering — this is exactly what I focus on.

  Stay connected:

  → Subscribe on Medium:
  → GitHub — tools & labs: was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

  Vollständiger Original-Bericht

  Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf infosecwriteups.com.

  ↗ Original-Artikel auf infosecwriteups.com lesen