Pranith-Jain/dfir-threat-intel-platform

dfir-threat-intel-platform

A 98+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 426-tool MCP server — on one Cloudflare Workers deploy. Edge-cached, free at the edge, no signup required.

[Live platform →](https://pranithjain.qzz.io/dfir) · Threat Intel → · MCP catalog →

MIT licensed. Built and maintained by Pranith Jain — Security Analyst, Threat Intel · Email Defense · Security Automation.

---

👋 The person behind it

This repo is the work, not the résumé. For the personal portfolio — background, experience, certifications, case studies, and the reasoning behind these projects — go to:

[pranithjain.qzz.io](https://pranithjain.qzz.io)

| | | | ------------- | ---------------------------------------------------------------------------------------------------------------------------- | | Focus | Threat intelligence & IOC analysis · detection engineering · email security & BEC · security automation | | Currently | Associate Cyber Security Analyst, CERT Threat & Vulnerability Intelligence Group | | Also | LinkedIn · GitHub · hello@pranithjain.qzz.io |

The portfolio is the _first surface_ of the same deploy (/, /about, /skills, /experience, /projects) — it is simply not what this repository is about. Everything below is the platform.

---

Three surfaces, one deploy

1. Portfolio (/, /about, /skills, /experience, /projects)

React + Vite + TypeScript with SSR prerendering. Hero, skills grid, timeline experience, certifications, featured work, contact CTA. Dark/light, responsive, accessible, fast first paint via prerendered routes.

2. DFIR Toolkit — CRUCIBLE (/dfir/*)

98+ interactive analyst tools across 21 categories — triage, OSINT, email security, detection engineering, AI security, data security, crypto tracing, malware analysis, and more. Zero signup, zero keys to start. Includes a universal rule converter (Sigma / KQL / SPL / Lucene / EQL / YARA / DLP) and a purpose-built detection engine.

3. Threat Intel Platform — PANOPTICON (/threatintel/*)

A live CTI surface that updates itself: ransomware leak-site + negotiation tracking, CVE/KEV feeds, cross-source IOC firehose with consensus scoring, actor timelines, dark-web/forum intelligence, social/Telegram/Reddit firehoses, a 3D Global Pulse threat globe, auto-generated briefings, and a fully autonomous case-study blog (discover → QA → publish) — all hourly-refreshed, all on the free tier.

---

Threat Intel Platform — surfaces at a glance

| Surface | What it does | | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | Live Ransomware Activity | Leak-site claims merged across Ransomlook, ransomware.live, MyThreatIntel & Andrea Fortuna; per-victim screenshots | | Ransomware Groups Directory | 630-group leak-site directory — status, 7d victims, profiles, recent moves (Sinon-style reference) | | AI Escape Watch | 15-incident agent containment-failure registry — CBS scores, 7-stage chains, absent-guardrail analysis | | Ransomware Negotiations | ransomware.live PRO negotiation chats — demand vs. settled, discount %, full transcripts | | Actor Activity Timeline | Per-actor leak-site cadence heatmap + MITRE ATT&CK group/TTP pivot | | Victim Re-leak Trends | Sector + operation-type breakdowns, group re-claim pairs, re-leak timeline | | Infostealer Live Tracker | HudsonRock victim exposure, log-market threads, stealer-log directory, family-matched IOCs (metadata only) | | Breach / Leak-Forum Tracker | deepdarkCTI criminal-forum + dark-market directory — names/status/links only | | CVE List | NVD + CISA KEV merge, EPSS/KEV-aware, MyThreatIntel API-primary with TG-scrape fallback | | IOC Correlation | Cross-source consensus scoring across 21 feeds | | Live IOC Stream | Chronological multi-source firehose | | Threat Pulse | Entities ranked by cross-source mentions over 24h | | Global Pulse | 3D interactive threat globe — 700+ geo-coded events across 33 layers | | Threat Intel Metrics | 16 hand-rolled SVG panels with live deltas | | Dark Web Watch | Aggregated leak-site/breach/research RSS, keyword watchlist | | Telegram / Reddit / Social | Curated public Telegram channels, infosec subreddits, Bluesky+Mastodon | | Live Breach Disclosures | Have I Been Pwned feed with verification flags | | Onion Watch | .onion mirror inventory for ransomware leak sites | | Cyber Crime & Fraud | Indictments, crypto-crime tracing, breach reporting | | Tech & AI News / Scam Watch | Curated multi-section RSS aggregations | | Intel Briefings | Daily/weekly auto-generated digests (cron-built, D1-backed) | | Case-Study Blog () | Autonomous pipeline: discover → score/dedupe → AI generate → QA gate → publish | | Writeups / Threat Actors / MITRE ATT&CK | Analyst-blog aggregation, APT catalogue, full matrix, dark-web index | | Feed Status | Health dashboard for every upstream + internal feed | | Catalogs | CVE Resources (~70), SecOps Tools (187), OSINT Framework (70+), Knowledge Base |

---

DFIR Toolkit — tools at a glance

| Category | Tools | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Triage & IOCs | IOC & Hash Checker (streaming, 60+ providers), Malware Scanner, IOC Extractor, Decoder/Encoder, PowerShell Deobfuscator, Timestamp Converter, Hash Calculator | | Domain & Network | Domain Lookup, Full Spectrum Domain, ASN Lookup, Exposure Scanner, Web Vuln Scanner, Subdomain Takeover, Certificate Search, Domain/IP & URL Reputation | | OSINT | Username Pivot (50+ services), Wayback Pivot, IP Geo, SOCMINT Pivots, URL Preview, EXIF, Reverse Image, Homograph Detector, Crypto Tracer, Dork Builder, Brand Impersonation, OSINT Mapper | | Email Security | Phishing Email Analyzer, EML Attachment Extractor, Email Defense / BEC Score, Email Reputation | | Vulns & Identity | CVE Lookup (NVD + CVSS + EPSS + KEV), Breach Checker, JWT Inspector | | Detection Engineering | YARA/Sigma Playground, YARA Rule Manager, LOLBins/GTFOBins, Log Parser, STIX 2.1 Viewer, Rule Converter | | Frameworks & Posture | Kill Chain, Diamond Model, OWASP Top 10, NHI Inventory, Tabletop Generator, GRC Maturity | | AI Security | Prompt Injection & Red-Team, MCP & Claude Code Auditor, AI Agent Attack-Surface Mapper, MITRE ATLAS | | Data Security | Sensitive Data Detector, Data Classification, Privacy Hub (GDPR/CCPA/DPDP/HIPAA/PCI) | | Crypto & Blockchain | Fund-Flow Tracer (BTC/ETH/Solana/Tron), Wallet Risk Scoring, Address Watch & Alerts | | Malware Analysis | Malware Capabilities, Sample Scanner, PE Analysis, String Extraction |

IOC providers (60+): VirusTotal, AbuseIPDB, Shodan, Censys, Netlas, OTX, URLScan, Hybrid Analysis, GreyNoise, CrowdSec, VulnCheck, Maltiverse, PulseDive, PhishTank, YARAify, StalkPhish, and many more — all optional, the toolkit works with zero keys.

---

MCP Server

A 426-tool MCP (Model Context Protocol) server runs on the same Worker, exposing every DFIR and threat-intel capability to AI agents. Connect Claude Desktop, Cursor, or any MCP client.

Repo: dfir-mcp-server

---

Tech stack

| Layer | Choice | | --------------- | -------------------------------------------------------------------------------------------------------------------- | | Frontend | React 19 + Vite + TypeScript + Tailwind | | Routing | React Router v7, lazy-loaded (299 route components) | | SSR | Prerendered routes for instant first paint | | Backend | Cloudflare Workers + Hono | | Storage | KV (briefings, dedup, rate-limit), Cache API (provider/feed results), D1 (briefings DB), Vectorize (semantic search) | | Durable Objects | 8 — MCP server, cron lock, live feed, report builder, investigator agent, radar crawler, global pulse | | AI | Groq (primary) → Workers AI (fallback) for case-study engine; Gemini for agent QA |