> For the complete documentation index, see [llms.txt](https://brunosergio.gitbook.io/cti/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://brunosergio.gitbook.io/cti/readme.md).

# README

**AI + Markdown. Finished threat intelligence.**

A one-person, AI-driven threat intelligence platform. Structured campaign files, weekly sightings, and daily spot reports — collected, corroborated, and written by an agentic CTI pipeline, then published here for free.

Everything you read on this site is a plain Markdown file. Read it in your browser, export it to PDF, copy the raw Markdown, ask the built-in AI about it, or send any page straight to your own LLM.

***

## Why this exists

Threat intelligence is usually trapped in one of two places: a heavy enterprise platform that needs a team to run it, or a PDF that no machine can read.

This project takes a third path — **finished intelligence as Markdown**, written to be equally useful to a human skimming it over coffee and to an LLM ingesting it into a RAG pipeline.

That single choice drives everything else:

| Principle                    | What it means here                                                                                             |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------- |
| **Markdown + YAML**          | Open formats, no vendor lock-in. Every report is a file you can grep, diff, and version.                       |
| **Lightweight**              | No PostgreSQL, no Redis, no Docker swarm. Git is the database.                                                 |
| **AI-ready**                 | Every file is consumable by LLMs, RAG pipelines, and autonomous agents by default — not through a bolt-on API. |
| **Progressive enrichment**   | Start with wide, cheap sweeps. Deep-dive only on real signals. Let the entity graph build itself over time.    |
| **Deterministic guardrails** | AI does the synthesis; code enforces the quality. Every claim is source-graded and validated before it lands.  |

***

## Read it everywhere

Three formats, one source.

#### 🧠 For humans

**Browse the web or export to PDF.** Read threat reports, campaigns, and sightings as polished markdown — built for the analyst scanning it over coffee or a briefing that needs to ship today.

#### 🤖 For agents

**Use reports in your own pipelines.** Every page is machine-readable markdown — perfect for RAG systems, agentic workflows, and LLM-driven analysis. Route campaigns into your threat models, feed sightings into your automation, or build custom analyses on top.

#### 📊 For LLMs

**Send any page straight to Claude, ChatGPT, or your tool.** Every report carries full context — threat actors, CVEs, ATT\&CK mappings, sources, reliability grades. Paste and ask your own questions without rewriting the data.

***

## Start here

#### 📋 [Finished Intelligence](https://brunosergio.gitbook.io/cti/finished-intelligence)

**Campaigns, attacks, and threat actors.** Curated incident files — attribution, tactical flow, key judgments, courses of action.

#### 🔍 [Weekly Sightings](https://brunosergio.gitbook.io/cti/osint-collection/sightings)

**Raw collection by source.** Forums, news, Twitter/X, Reddit — tagged by relevance and reliability.

***

## Who it's for

* **Solo analysts** — one-person CTI shops that need daily finished intelligence without hours of manual collection and triage.
* **Small SOCs** — teams of 2–10 with no dedicated CTI budget, who still need automated tracking across forums, leak sites, and OSINT.
* **Researchers and journalists** — investigators covering cyber operations who want structured, queryable threat data without an enterprise platform.

### Why not OpenCTI, MISP, or Maltego?

Those are excellent tools — for teams that can run them. This project optimises for a different constraint: one person, no infrastructure budget, and an AI-first workflow.

|                    | CTI Vault                   | Traditional platforms              |
| ------------------ | --------------------------- | ---------------------------------- |
| **Infrastructure** | Markdown + git — zero infra | PostgreSQL, Redis, Docker, workers |
| **AI-native**      | Built for LLMs end to end   | Manual workflows, bolt-on APIs     |
| **Operations**     | Fully automated pipeline    | Dedicated ops team required        |

***

## Roadmap

Breach reports (weekly rollups) · threat briefs (quarterly executive) · profile reports (actor dossiers) · landscapes (theme, region, sector) · IOC feeds · STIX 2.1 export for MISP and OpenCTI · trend views · Discord alerting.

***