|
| 1 | +<!DOCTYPE html> |
| 2 | +<html lang="en"> |
| 3 | +<head> |
| 4 | + <meta charset="UTF-8"> |
| 5 | + <meta name="viewport" content="width=device-width, initial-scale=1.0"> |
| 6 | + <title>GNAT — Python Cyber Threat Intel Made Simple</title> |
| 7 | + <meta name="description" content="GNAT (GNAT's Not A TIP) — A production-ready Python library for unified cyber threat intelligence across 159 platforms with STIX 2.1 ORM, AI agents, and detection rule translation."> |
| 8 | + <meta property="og:title" content="GNAT — Python Cyber Threat Intel Made Simple"> |
| 9 | + <meta property="og:description" content="One library. Every platform. Total control. 159 connectors, STIX 2.1 ORM, AI agents, HuntGNAT detection rules, campaign tracking, and telemetry ingestion."> |
| 10 | + <meta property="og:image" content="assets/images/og-image.png"> |
| 11 | + <meta property="og:type" content="website"> |
| 12 | + <link rel="icon" href="assets/images/favicon.ico"> |
| 13 | + <link rel="apple-touch-icon" href="assets/images/apple-touch-icon.png"> |
| 14 | + <link rel="stylesheet" href="assets/css/style.css"> |
| 15 | +</head> |
| 16 | +<body> |
| 17 | + |
| 18 | +<!-- Nav --> |
| 19 | +<nav> |
| 20 | + <div class="container"> |
| 21 | + <a href="#" class="brand"> |
| 22 | + <img src="assets/images/gnat-logo-64.png" alt="GNAT Logo"> |
| 23 | + GNAT |
| 24 | + </a> |
| 25 | + <ul> |
| 26 | + <li><a href="#features">Features</a></li> |
| 27 | + <li><a href="#platforms">Platforms</a></li> |
| 28 | + <li><a href="#install">Install</a></li> |
| 29 | + <li><a href="https://github.com/wrhalpin/gnat">GitHub</a></li> |
| 30 | + </ul> |
| 31 | + </div> |
| 32 | +</nav> |
| 33 | + |
| 34 | +<!-- Hero --> |
| 35 | +<section class="hero"> |
| 36 | + <div class="container"> |
| 37 | + <img src="assets/images/gnat-logo-full.png" alt="GNAT Mascot"> |
| 38 | + <h1>GNAT</h1> |
| 39 | + <p class="tagline">One library. Every platform. Total control.</p> |
| 40 | + <p class="subtitle">Python Cyber Threat Intel Made Simple</p> |
| 41 | + <div class="badges"> |
| 42 | + <span class="badge teal">159 Connectors</span> |
| 43 | + <span class="badge green">5,100+ Tests</span> |
| 44 | + <span class="badge teal">STIX 2.1</span> |
| 45 | + <span class="badge amber">Python 3.9+</span> |
| 46 | + <span class="badge teal">Apache 2.0</span> |
| 47 | + </div> |
| 48 | + </div> |
| 49 | +</section> |
| 50 | + |
| 51 | +<!-- Stats --> |
| 52 | +<section> |
| 53 | + <div class="container"> |
| 54 | + <div class="stats"> |
| 55 | + <div class="stat"><div class="number">159</div><div class="label">Platform Connectors</div></div> |
| 56 | + <div class="stat"><div class="number">5,100+</div><div class="label">Unit Tests</div></div> |
| 57 | + <div class="stat"><div class="number">55</div><div class="label">Architecture Decision Records</div></div> |
| 58 | + <div class="stat"><div class="number">15</div><div class="label">Ingest Readers</div></div> |
| 59 | + <div class="stat"><div class="number">26</div><div class="label">Rule Engine Helpers</div></div> |
| 60 | + <div class="stat"><div class="number">4</div><div class="label">Detection Rule Translators</div></div> |
| 61 | + </div> |
| 62 | + </div> |
| 63 | +</section> |
| 64 | + |
| 65 | +<!-- Features --> |
| 66 | +<section id="features"> |
| 67 | + <div class="container"> |
| 68 | + <h2>Key Capabilities</h2> |
| 69 | + <div class="features"> |
| 70 | + <div class="card"> |
| 71 | + <h3>159 Platform Connectors</h3> |
| 72 | + <p>Uniform CRUD + bidirectional STIX 2.1 translation. ThreatQ, CrowdStrike, Splunk, Sentinel, MISP, VirusTotal, Mandiant, and 152 more.</p> |
| 73 | + </div> |
| 74 | + <div class="card"> |
| 75 | + <h3>STIX 2.1 ORM</h3> |
| 76 | + <p>Property-bag ORM for Indicators, ThreatActors, Malware, Vulnerabilities, Campaigns, AttackPatterns, Relationships, and Observables.</p> |
| 77 | + </div> |
| 78 | + <div class="card"> |
| 79 | + <h3>HuntGNAT Detection Rules</h3> |
| 80 | + <p>Translate STIX patterns to Sigma, YARA, Suricata, and Snort rules. Hunt packages, ATT&CK coverage matrix, deployment drift detection.</p> |
| 81 | + </div> |
| 82 | + <div class="card"> |
| 83 | + <h3>Attribution & Campaigns</h3> |
| 84 | + <p>Diamond Model, kill-chain progression, competing hypotheses with Admiralty Scale scoring, actor profiles, cluster-to-campaign promotion.</p> |
| 85 | + </div> |
| 86 | + <div class="card"> |
| 87 | + <h3>Analysis Rule Engine</h3> |
| 88 | + <p>Hy/Lisp declarative rules for automated hypothesis evaluation. 26 helpers, audit trail, AI-60 confidence ceiling, priority first-match.</p> |
| 89 | + </div> |
| 90 | + <div class="card"> |
| 91 | + <h3>Telemetry Ingestion</h3> |
| 92 | + <p>Kafka consumer for honeypot, netflow, IDS, and DNS sensor data. Redis dedup, automatic campaign linking, severity gating.</p> |
| 93 | + </div> |
| 94 | + <div class="card"> |
| 95 | + <h3>AI Agents</h3> |
| 96 | + <p>Unified LLMClient (Claude, OpenAI, Grok, Gemini). ResearchAgent, ParsingAgent, quality and security sub-agents.</p> |
| 97 | + </div> |
| 98 | + <div class="card"> |
| 99 | + <h3>Investigation Builder</h3> |
| 100 | + <p>Five-step cross-platform evidence graph: seed → expand → normalise → correlate → materialise. Infrastructure role classification.</p> |
| 101 | + </div> |
| 102 | + <div class="card"> |
| 103 | + <h3>Reports & Dissemination</h3> |
| 104 | + <p>PDF, DOCX, HTML, Markdown. TAXII 2.1 server, webhook fan-out with HMAC signing, STIX bundle export.</p> |
| 105 | + </div> |
| 106 | + </div> |
| 107 | + </div> |
| 108 | +</section> |
| 109 | + |
| 110 | +<!-- Platforms --> |
| 111 | +<section id="platforms"> |
| 112 | + <div class="container"> |
| 113 | + <h2>159 Supported Platforms</h2> |
| 114 | + <div class="platforms"> |
| 115 | + <span>ThreatQ</span><span>CrowdStrike</span><span>Splunk</span><span>Sentinel</span> |
| 116 | + <span>VirusTotal</span><span>Mandiant</span><span>MISP</span><span>OpenCTI</span> |
| 117 | + <span>Elastic SIEM</span><span>QRadar</span><span>Cortex XDR</span><span>SentinelOne</span> |
| 118 | + <span>Palo Alto XSOAR</span><span>Wiz</span><span>Orca Security</span><span>Okta</span> |
| 119 | + <span>Entra ID</span><span>CrowdStrike</span><span>Recorded Future</span><span>AlienVault OTX</span> |
| 120 | + <span>Shodan</span><span>GreyNoise</span><span>Censys</span><span>Joe Sandbox</span> |
| 121 | + <span>ANY.RUN</span><span>Hybrid Analysis</span><span>Cuckoo / CAPEv2</span><span>VMRay</span> |
| 122 | + <span>Darktrace</span><span>Vectra AI</span><span>ExtraHop</span><span>Carbon Black</span> |
| 123 | + <span>Proofpoint TAP</span><span>Mimecast</span><span>Abnormal Security</span><span>IRONSCALES</span> |
| 124 | + <span>ServiceNow</span><span>Jira</span><span>TheHive</span><span>Velociraptor</span> |
| 125 | + <span>HackerOne</span><span>Bugcrowd</span><span>AbuseIPDB</span><span>MITRE ATT&CK</span> |
| 126 | + <span>CISA KEV</span><span>Dataminr</span><span>Flashpoint</span><span>Intel 471</span> |
| 127 | + <span>+ 111 more...</span> |
| 128 | + </div> |
| 129 | + </div> |
| 130 | +</section> |
| 131 | + |
| 132 | +<!-- Install --> |
| 133 | +<section id="install"> |
| 134 | + <div class="container"> |
| 135 | + <h2>Get Started</h2> |
| 136 | + <div class="install-block"> |
| 137 | + <div>pip install gnat</div> |
| 138 | + <div style="color: var(--muted); margin-top: 12px;"># Optional extras</div> |
| 139 | + <div>pip install "gnat[telemetry]" # Kafka + Redis</div> |
| 140 | + <div>pip install "gnat[rules]" # Hy rule engine</div> |
| 141 | + <div>pip install "gnat[analysis]" # Campaign tracking</div> |
| 142 | + <div>pip install "gnat[serve]" # Web dashboard</div> |
| 143 | + <div>pip install "gnat[all]" # Everything</div> |
| 144 | + </div> |
| 145 | + </div> |
| 146 | +</section> |
| 147 | + |
| 148 | +<!-- Footer --> |
| 149 | +<footer> |
| 150 | + <div class="container"> |
| 151 | + <p>GNAT — GNAT's Not A TIP — Version 1.5.0</p> |
| 152 | + <p style="margin-top: 8px;"> |
| 153 | + <a href="https://github.com/wrhalpin/gnat">GitHub</a> · |
| 154 | + Apache License 2.0 · |
| 155 | + Python 3.9 – 3.13 |
| 156 | + </p> |
| 157 | + </div> |
| 158 | +</footer> |
| 159 | + |
| 160 | +</body> |
| 161 | +</html> |
0 commit comments