FIREWATCH//CTI — User Guide

A single-file, browser-based Cyber Threat Intelligence operations console. It maps observed tradecraft to MITRE ATT&CK, attributes activity to threat groups, ingests live intel, and turns scans and reports into hunt plans — all client-side, no server.

Getting started

1. Open console.html (or the Launch Console button on the landing page) in a modern browser (Chrome, Edge, or Firefox). Everything runs locally in the page.
2. On first launch it downloads the MITRE ATT&CK Enterprise bundle (~50 MB) and builds a local model. This is cached in your browser (IndexedDB) for 7 days, so subsequent loads are instant.
3. When the top bar shows ATT&CK: v… · N groups · N techniques, you're ready.
4. Switch tabs with the top navigation or press 1–9. Hover almost anything for an inline explanation.

Fastest way in — the demo

On first launch a welcome panel offers to load a demo investigation. It drops a fictional intrusion report into the Extractor, auto-extracts the techniques, lights up Attribution, and files everything — TTPs and IOCs — into a ready-made case. It is the quickest way to see the whole pipeline end to end. You can re-run it any time from the empty Attribution screen, the empty Cases screen, or the command palette.

Core concepts

1 · Attribution core

Select the TTPs you observed in an intrusion and rank the threat groups most likely responsible, using a naive-Bayes posterior over ATT&CK group–technique mappings.

1. In the left Technique Selection panel, expand a tactic or search (e.g. lsass or T1003) and click techniques to select them.
2. The center Attribution Probability list ranks groups live as you select. Bars show normalized posterior probability.
3. Read the confidence banner — it warns about single observables, weak matches, or low separation between candidates, to resist over-attribution.
4. Click any group to open its full dossier; use the Evidence Matrix to see which candidate uses which of your TTPs.
5. The right panel suggests mitigations and detections ranked by how many of your techniques they cover — your SOC bridge.

2 · Intel Feed core

Three live modes. Reports and vulnerabilities are filtered to your sector; IOC feeds are global. Report sources are curated in js/sources.js — the one file to edit to add feeds — leaning on the community-maintained awesome-threat-intelligence list.

1. Pick your Sector and time Window.
2. (Vulnerabilities) set a minimum CVSS, or check Exploited only for KEV.
3. Click ◈ Ingest. Expand any item for its BLUF, IOCs (with pivot links), and inferred techniques.
4. Define ⚑ PIRs (actors/keywords) so matching reports float to the top on the next ingest.
5. After ingest, a bar shows how fresh the results are and how many sources responded — click the failure count to see which feeds were unreachable. Results are cached, so switching tabs and back does not re-fetch.

2b · IOC Feeds new

Switch the Intel Feed to ◈ IOC FEEDS mode to work with open machine-readable blocklists, curated from the awesome-threat-intelligence list. Everything is fetched into browser memory — nothing is sent anywhere.

1. Click ◈ Ingest to fetch all ten feeds (or fetch feeds individually). Each card shows the live indicator count.
2. Lookup: paste any indicator — IP, domain, URL, or SSL SHA-1, defanged is fine — and hit ⌕ Check. Hits show which feeds list it (and why, when the feed says, e.g. the malware family from ThreatFox or the number of blocklists from IPsum). One click adds it to the active case.
3. ◈ Cross-check active case: every IOC accumulated on your active case is checked against every fetched feed at once — instant triage of which of your indicators are already publicly known-bad.

3 · Report Extractor core enhanced — Barracuda

Turn any unstructured threat report into ATT&CK techniques using 4-layer matching: explicit IDs, exact technique names, ~55 curated analyst-phrasing patterns, and TF-IDF semantic sentence matching.

Getting text in — three ways

1. Paste directly into the box.
2. ↧ URL — paste a link to a vendor blog or advisory; readable text is scraped via proxy into the box.
3. ↥ PDF — load a PDF report; text is extracted locally in-browser with pdf.js (nothing is uploaded).

Then click Analyze Report. Toggle the output between two views:

4 · APT Profiles core

A searchable dossier for every tracked group: aliases and G-ID, tactic footprint, associated software, attributed campaigns with date ranges, and the group's most distinctive (rarest) TTPs. Search by name, alias, or G-ID; optionally filter to financially-motivated groups. Each dossier can export a Navigator layer of that group's technique usage.

5 · Compare core

Pick 2–3 groups to see shared vs. unique techniques and a Jaccard similarity score. Useful when two actors are easy to confuse — the "unique" columns show each group's distinctive tradecraft that actually discriminates between them.

6 · Cases core now the spine

A case is a living investigation, not just a TTP snapshot. It accumulates TTPs, IOCs, CVEs and reports from every tab (see Active Case spine). The active case is highlighted with a green marker. For any case you can Set active, Load TTPs back into Attribution, edit its name/notes (✎), export a 📄 Markdown intelligence report (summary, attribution ranking, TTP table, IOC appendix — the artifact you paste into a ticket or wiki), list its IOCs, or export a STIX 2.1 bundle (attack-patterns + top attributed group + IOC indicators, for MISP/OpenCTI) or a candidate Sigma rule. Cases persist in your browser.

7 · Scan → TTP new — Piranha

Translate vulnerability findings into adversary techniques. Import a Nessus scan or paste CVEs; each CVE is mapped to ATT&CK techniques via the cve2capec database, then shown as a CVSS-weighted heatmap.

1. Nessus: choose a .nessus / .xml export — CVEs, CVSS scores and hosts are parsed locally. Or paste CVE IDs (one per line or comma-separated) into the CVE list.
2. Click ◈ Map CVEs → Techniques. The relevant year(s) of the cve2capec database are fetched once and cached; every CVE is resolved to techniques.
3. The right panel lists mapped techniques, sorted by heat. The colored bar and score reflect the highest CVSS of any CVE mapping to that technique. Expand a row to see the contributing CVEs.
4. Use Load techniques → Attribution to pivot into group attribution, or ⤓ Navigator heatmap to export a scored ATT&CK layer.

8 · Hunt Plan rebuilt

The Hunt Plan turns what you have observed into what to look for next — driven by your selection and automatic attribution.

Source & auto-attribution

Pick where your observed techniques come from — your current selection, the active case, or a specific APT's footprint. FireWatch immediately runs attribution over that set and shows the most likely actor, its posterior confidence, and how much of your set matches — with the same over-attribution caveats as the Attribution tab. (The likely actor also shows live in the active-case bar as you work, across every tab.)

Coverage & kill-chain spread

Two coverage meters show what fraction of your observed techniques have documented ATT&CK detections and mitigations — your defensive readiness at a glance. A kill-chain bar shows how your techniques spread across tactics, so gaps in the chain are obvious.

Hunt hypotheses

This is the core of the rebuilt tab. Given the attributed actor, FireWatch lists the techniques that actor is known to use but you have not observed yet — ranked most-distinctive first — each annotated with its documented detection strategy and mitigation (or flagged as a telemetry gap where none exists). It is a concrete "go look for these next" list. Click any hypothesis to fold it into your working selection.

Detection blind spots

Finally, any observed technique with no documented detection strategy is surfaced as a blind spot — validate that you actually have telemetry for it.