Howdy, good people. I disappeared, did every administrative task a human being can do, moved across the world, and built a threat intelligence aggregator along the way. Since we last spoke, I’ve landed in Ireland – so long, Rocky Mountains, and hello, evergreen land of the bottomless pint.
A few notes on the move before we dive in: flying halfway across the world with a cat is no easy feat, your moving budget will be comedically underestimated, and after all the blood, sweat, and tears, it turns out to be more than worth it.
Thanks for hanging in there. This announcement has been a long time coming, and I’m stoked to finally share a tool I built out of frustration with doing threat actor research across four platforms and a hundred browser tabs.
Drumroll please……… introducing THEORY, the multi-source threat actor intelligence tool of your dreams, for the humble and accessible price of $0 (forever)!
What THEORY is
THEORY is an open-source threat intelligence aggregator. You give it a threat actor, it gives you a dossier – everything the security community knows about the group, pulled together in one place.
One command gets you there:
$ theory --actor [insert "APT" & number or just an alias]The dossier renders in your terminal and saves to markdown. Every other format – JSON, STIX, CSV, an ATT&CK Navigator layer, a shareable HTML file, a full IR playbook – is a single flag away, and we’ll walk through those below.
It also doesn’t much care what you call the actor. Fancy Bear, Forest Blizzard, Sofacy, and STRONTIUM (all case-insensitive) resolve to the same canonical dossier, and the output file is always named for the canonical actor, so --actor “Fancy Bear” still writes apt28.md. As of this writing, THEORY knows 35 actors by 275 aliases.
Why it exists
Noobs have an access problem (it’s me, I’m the noob)! Just as important, the enterprise threat intelligence market has a pricing problem. The platforms that do multi-source aggregation and correlation cost well into the tens of thousands of dollars a year, sometimes six figures. That works if you’re a Fortune 500 SOC. If you’re a student, an independent researcher, a small-team analyst, or someone trying to break into the field and build real skills with real tools, you’re locked out.
The data sources are public. The frameworks are public. The vendor blog posts are public. The only thing missing was a tool to bring them all together, correlate them, and produce something you could hand to your team lead or drop into a briefing.
What you get
Run THEORY with no format flags, and it queries MITRE ATT&CK, CISA, and Malpedia by default, resolves the actor across all sources, deduplicates, normalizes everything into a single schema, and renders a full dossier in your terminal.
$ theory --actor [insert actor]The dossier opens with an LLM-written Intelligence Overview: a four- to six-sentence executive synopsis drawn from the whole aggregated profile. Below that, you get a structured TTP table with confidence scores and detection guidance; a malware inventory with descriptions, targeted sectors, and campaigns with ATT&CK references; CISA advisories; and a confidence summary showing how many sources corroborated each finding. That same dossier saves to markdown automatically.
Add more sources, and it gets deeper:
$ theory --actor APT29 --sources mitre,cisa,malpedia,otx,sigma,threatfoxNow you also get community IOCs from AlienVault OTX with confidence scores and freshness indicators (fresh, aging, stale), all automatically defanged. ThreatFox adds IOCs attributed to malware families. SigmaHQ maps detection rules straight to the actor’s techniques, so you’re looking at TTPs alongside the rules that catch them. Every indicator is deduplicated across sources, and confidence scores climb when multiple sources agree.
Bring your own keys
THEORY scales to whatever you’re willing to put into it. Five of the seven core sources – MITRE ATT&CK, CISA, Malpedia, SigmaHQ, and ThreatFox – require no API key, no account, and no signup. Clone the tool, and you’re already generating real dossiers on 35 actors.
From there, you trade keys for depth, not dollars. A free AlienVault OTX key (grab one at otx.alienvault.com) unlocks community IOCs with confidence and freshness scoring. An LLM key – whatever provider you point to in your .env – powers the Intelligence Overview at the top of every dossier and the vendor synthesis that reads 40+ research blogs for your specific actor. No LLM key, no problem: THEORY still builds the full structured dossier from the raw data; it just skips the written synopsis.
When v1.2 lands, the same principle will extend to enrichment: Shodan, Censys, CriminalIP, and VirusTotal each slot in with a free-tier key, adding live infrastructure context to the IOCs you’re already pulling.
Output formats
Everything THEORY collects is format-agnostic. Ask for whatever your workflow needs, and add --output all to get the lot at once.
I. A raw JSON profile. Every data point that THEORY collects is structured and machine-readable.
$ theory --actor “Lazarus Group” --output jsonII. A valid STIX 2.1 bundle you can import straight into MISP, OpenCTI, Splunk Enterprise Security, or Microsoft Sentinel, with full relationship modeling: intrusion sets, attack patterns, malware objects, indicators, and the links between them.
$ theory --actor Turla --sources mitre,malpedia --output stixIII. An IOC-only CSV with raw (not defanged) values, formatted for SIEM lookup table ingestion.
$ theory --actor Sandworm --sources mitre,otx,threatfox --output csvIV. An ATT&CK Navigator layer, color-coded by confidence (red high, amber medium, yellow low), with a score boost for techniques that have Sigma coverage. Drop it into MITRE’s Navigator for an instant heatmap of the actor’s known tradecraft.
$ theory --actor APT41 --sources mitre,malpedia --output navigatorV. A self-contained HTML dossier: collapsible sections, a sortable TTP table, tactic filter buttons, IOC freshness indicators, malware cards, vendor intel cards, and a confidence summary header. No server, no dependencies. Opens in any browser, works offline, shares as a single file.
$ theory --actor “Volt Typhoon” --sources mitre,cisa,malpedia --output htmlVI. An incident response playbook: IOC blocks formatted for your firewall, a detection checklist grouped by tactic with Sigma rule links, LLM-generated hunt hypotheses for each high-confidence TTP, malware reference cards, containment guidance, and every source URL cited in the profile. Need it in Jira? Add --playbook-format jira and paste it into an issue.
$ theory --actor APT28 --sources mitre,sigma --output playbookCoverage gap analysis
If you already run Sigma rules, THEORY can show you exactly where your blind spots are. Point it at your rules directory, and it compares the actor’s TTPs against what you can currently detect, then reports coverage percentage, covered techniques, and gaps sorted by confidence.
$ theory --actor APT28 --sources mitre,sigma --detection-path ~/my-sigma-rulesVendor intelligence
Add the vendor source and THEORY fetches recent articles from 40+ security research blogs (Mandiant, Google TAG, Unit 42, CrowdStrike, Kaspersky GReAT, and more), then uses an LLM to synthesize what each one says about your actor specifically. Every summary is attributed to its source and linked to the original. Need it boardroom-ready? Add --output exec --sector telecommunications for a non-technical, BLUF-format summary tailored to your industry.
What it can’t do yet
THEORY is CLI-only right now, and calling the interface complex would be an understatement. There are a lot of flags (theory --help for the full list). If you’re comfortable in a terminal, it’s powerful. If you’re not, the barrier to entry is higher than I’d like, and a web UI is at the top of the roadmap.
v1.2 is scoped for IOC enrichment: Shodan host data and C2 detection, Censys certificate lookups, CriminalIP threat scoring, and VirusTotal reputation checks, all free-tier compatible. The goal is to add live context to the IOCs THEORY already collects, so your dossier tells you which indicators are still active infrastructure.
After that, the LLM layer gets deeper: historical campaign analysis, cross-actor correlation, and a conversational query mode where you can ask questions against the aggregated profile.
THEORY’s Internal Security Practices
THEORY is built by and for security people, so it’s held to that standard: no telemetry, no phone-home, secrets kept out of source, defanged output everywhere, prompt-injection defenses on anything that reaches an LLM, and hardened parsing on third-party feeds. A short follow-up article walking through the security features built into the tool is already on the way.
If you want the full picture now, here’s the link:
Check out THEORY's security rundown here.
Give it a whirl!
THEORY is live on GitHub under the Threatcraft org. Clone it, install it, and run your first dossier in under five minutes. There are 337 offline tests you can run without a single API key.
The repo ships with a demo script that runs through everything above. Once you’ve installed and initialized the tool, make it the demo executable and let it rip:
chmod +x demo.sh
./demo.shIf something breaks, there's an issues tab. If you want to add an actor or a vendor feed, there's a contributing guide. But more than anything, use it! Clone the repo, run a dossier on the actor that's been living rent-free in your head, and see the whole picture assemble in one place, no logins, no tabs, no invoice. I built THEORY because I was tired of being locked out of cohesive, organized intelligence.
As this tool continues to grow, I hope that every student, every self-taught analyst, every one-person security team will have the same or a similar starting line as a larger, better-funded threat intelligence team. If THEORY earns a spot in your workflow, drop a star on the repo and share so others can find it too!
Give it a whirl, let's see what you find.