Skip to content

Huntable CTI Studio

Reports to Rules... in Record time.

Huntable CTI Studio is an AI-assisted workbench for detection engineers and threat hunters. It ingests open-source threat intelligence from RSS feeds and web scraping, extracts platform-aware observables (command lines, process trees, registry keys, services, scheduled tasks, network indicators, hunt queries) across Windows, Linux, and macOS, and turns them into Sigma rules you can validate, review, and ship.

With full transparency, each article moves through an explicit LangGraph pipeline, execution state is persisted in PostgreSQL, configuration is versioned through presets, and novelty is enforced by similarity search against 3,000+ community Sigma rules. Bring your own model using OpenAI or Anthropic; LM Studio is available as an optional local LLM provider, and Codex can use a deployment-managed ChatGPT subscription for workflow inference.

Who Is This For?

Role What you get
Detection Engineers Auto-generated Sigma rules from CTI articles, validated and de-duplicated against SigmaHQ
Threat Hunters Extracted command-lines, process trees, and hunt queries ready for triage
SOC Analysts Curated, scored intelligence feed with semantic search via MCP
Contributors and agents A Docker-first stack with explicit workflow, config, and persistence contracts

Highlights

  • Multi-source aggregation — RSS feeds, direct scrape endpoints, and browser extension
  • Agentic workflows — Platform Detection → junk filter → ranking → extraction → Sigma generation → similarity → queue promotion; platform-aware routing skips Windows-only extractors for Linux/macOS articles
  • Detection support — validation, similarity matching, and coverage classification
  • Storage & services — FastAPI web app, PostgreSQL + pgvector, Redis, Celery worker/scheduler
  • Search & MCP retrieval — Semantic search across collected intelligence; conversational retrieval via the Huntable MCP server
  • MCP (optional) — Model Context Protocol server with read tools plus scoped, audited write tools; committed .mcp.json wires it up for project-aware clients with no setup (same env as the web app; tool reference)

Quick Start

Bash
git clone https://github.com/dfirtnt/Huntable-CTI-Studio.git
cd Huntable-CTI-Studio
./setup.sh --no-backups
./start.sh

setup.sh seeds the ML content-filter model automatically. If you ever need to re-seed (e.g. after restoring a database backup without the models volume): docker exec cti_web python3 scripts/seed_model.py.

If prompted, you can run the MkDocs docs server in the background; logs go to logs/mkdocs.log.

Health check: curl http://localhost:8001/health
Web UI: http://localhost:8001

Where To Go Next

I want to…

Features

Sigma Detection Rules

Automatically generate Sigma detection rules from CTI content. See Sigma Detection Rules.

Content Filtering

ML-based classification to filter low-quality content. See Content Filtering.

Platform Detection

Entity-driven platform classification that identifies Windows, Linux, and macOS content using a deterministic keyword knowledge base plus an LLM adjudicator for low-confidence cases. Replaces the retired CTI-BERT/SEC-BERT embedding detector. Platform-aware extractor routing skips Windows-only sub-agents (RegistryExtract, ServicesExtract, ScheduledTasksExtract) when non-Windows evidence is detected. See Platform Detection.

ProcTree Attention Preprocessor

Surfaces high-likelihood parent-child process spawn regions (Sysmon fields, tree glyphs, lineage verbs, PID/PPID pairs) as focused snippets before the full article is passed to ProcTreeExtract. Parallel to the existing CmdlineExtract preprocessor. Toggle via proc_tree_attention_preprocessor_enabled in workflow config.

Image OCR Ingest

Inline article images are OCR'd locally with Tesseract during ingest and folded into article content as [Image OCR: <url>] blocks, making image-embedded observables visible to all downstream extractors and Sigma generation with no consumer-side changes. Enabled by default (OCR_INGEST_ENABLED defaults to true in docker-compose.yml); override globally via that env var or per-source via the image_ocr_enabled tri-state config key. See Image OCR Ingest for the SSRF guard model, status vocabulary, and backfill script.

Semantic search across your CTI corpus using embeddings, accessed via MCP tools. See Semantic Search.

Model Versioning And Rollback

Train, evaluate, and roll back the content-filtering model through the MLOps control center. Every training run is versioned with metrics (accuracy, precision, recall, F1); rollback restores a prior artifact and re-scores all chunks in the background. See Content Filtering.

LLM Support

Huntable CTI Studio works with multiple LLM providers. LM Studio is strictly optional: the application starts and operates without it, and all embedding features use local sentence-transformers rather than LM Studio.

  • OpenAI — gpt-4o, gpt-4.1, gpt-4.1-mini, gpt-4.1-nano, o3, gpt-5 (and pattern-matched successors)
  • Anthropic — claude-haiku-4-5, claude-sonnet-4-6, and compatible variants
  • LM Studio (optional) — local LLMs (Gemma 4B, Qwen3, etc.)
  • Codex (optional) — deployment-managed ChatGPT subscription for workflow inference; authenticate in the workflow worker, not with an API key

See Local Model Selection Guide for recommendations.

Getting Help

Last updated: 2026-07-05 Last reviewed: 2026-09-01