TI Console

Threat-intel analyst workbench: parse reports, e-mails and HAR into indicators, ATT&CK matrix, case, report skeleton, rule drafts.

TI Console turns a threat-intelligence report into an annotated list of indicators, and does it entirely on your machine. No server, no account, no API keys, no telemetry. Indicators never leave the browser unless you yourself click a service to open. It was built for the part of an analyst's day that repeats: copy an indicator out of a 40-page vendor PDF, paste it into a reputation service, read the verdict, copy the next one, thirty times, then move everything into a table and into a report. WHAT GOES IN • Pasted text, a selection on a page, or the open page itself • Files: .eml, .har, PDF, logs, CSV • A page behind a URL — fetched as text, with no JavaScript, images or trackers The parser recognises 21 types: IPv4, IPv6, CIDR ranges, domains, URLs, e-mail addresses, MD5, SHA-1, SHA-256, SHA-512, CVE, BDU (Russian FSTEC) identifiers, ASN, registry keys, Windows paths, BTC and ETH wallets, onion addresses, Telegram channels, Discord invites and ATT&CK technique IDs. Defanged indicators are read the way reports actually write them: hxxp://, 1.1.1[.]1, example(dot)com, and the spellings used in Russian-language reports. A hash broken across a line in a PDF is stitched back together. NOISE IS SEPARATED, NOT DELETED Parsing a vendor's own report usually yields links to that vendor's blog and social accounts, its contact address, a running header repeating on every page — and seven hundred characters of an analytics counter URL. TI Console moves these into a separate group with the reason given, counted, one click away from coming back. Nothing is thrown out silently: a vendor domain becomes an indicator precisely when the vendor is breached, and the Google Analytics Measurement Protocol is used for exfiltration. Counter and tracker hosts are matched by domain and subdomains, never by substring, so roistat.com.attacker.tld stays in the main list. EVERY SERVICE CARRIES A DISCLOSURE LABEL 103 services in 9 categories. Every one shows what it will see: public — what you submit becomes publicly visible (VirusTotal, urlscan.io) — or limited, where a commercial service sees the query but does not publish it. Separate badges mark the services that need a free account and the ones that are useless without a paid plan. That label drives the one setting worth understanding before your first parse. DATA MODE Submitting a customer's indicator to a public service is irreversible, and an adversary watching their own infrastructure will see the interest. Every SOC has a rule against it; the rule survives on the analyst remembering it at the end of a shift. Switch Data mode to customer data and public services disappear — from the tree, from the cards, from the command palette. Playbooks drop the steps that would go to them and say which ones they dropped. The report skeleton and the rule drafts lose the case name. The ATT&CK matrix exported as an image carries no customer name. HAR response bodies become unavailable. Separately, if your SOC distributes a list of its own subnets and domains by browser policy, matching values never reach a public service even in public mode, and a single manual open asks for confirmation naming the policy entry that fired. The list is only compared locally and is never transmitted. CASE, MATRIX, REPORT • A case holds indicators, verdicts, what each was checked against, notes, sources, and a timeline that writes itself. One button turns the timeline into a shift-handover summary. • The ATT&CK matrix is built from a catalogue shipped inside the package — no network request, no version drift between analysts. Columns follow kill-chain order. Cell colour is the verdict from the case; a technique without a verdict stays colourless on purpose. • A ten-section report skeleton arrives with the indicator table, the timeline and the ATT&CK coverage already filled in, and prompts for the parts only an analyst can write — including a mandatory limitations section. • Exports: CSV (with BOM, so Cyrillic survives Excel), JSON, STIX 2.1, an ATT&CK Navigator layer, Markdown. DETECTION RULE DRAFTS Sigma (ECS fields), Suricata and YARA are generated from the case, with the word DRAFT in the rule title, its description and the alert it produces. A list of indicators does not know what is normal in a particular infrastructure. Private addresses, your own ranges and analyst notes never reach the rule, and what was replaced with placeholders is listed underneath. There is no "push to SIEM" button. WORK INSIDE THE REPORT Ctrl+Shift+1 highlights indicators on the page you are reading; clicking one opens a card next to the value with its type, the services that accept it, "add to case" and "copy defanged". The highlight matches how the page is written, stays out of input fields, and clicking a value inside a link does not follow the link. Nothing is injected until you ask: there is no persistent content script, and site access is an optional permission requested at first use. A side panel keeps the console next to the page instead of occupying a tab. Ctrl+K opens a palette over tools, playbooks, ATT&CK techniques and actions. WHAT IT IS NOT • Not a TI platform. It stores no feeds and links no investigations — OpenCTI and MISP exist for that. • Not an enrichment pipeline. It does not call APIs in batches on your behalf; it opens the service you chose, in a tab, as you. • Not a scanner. It performs no active reconnaissance. • Not evidence storage. The case lives in your browser profile; export before closing an investigation. PRIVACY The extension makes three kinds of outbound request, all on an explicit action: opening a service you picked, fetching a page whose URL you typed, and downloading the LOLBAS or GTFOBins reference on a button. No analytics, no accounts, no remote code. PDF parsing and rendering, the ATT&CK catalogue and every export run locally. OPEN SOURCE AND REPRODUCIBLE The source is published, and so are the build instructions and the expected SHA-256 of the package. The build is deterministic: rebuild it yourself and compare the hash with the published one. For a tool that handles customer indicators, that is the only way to know the store holds what the repository holds.