Huntable CTI Studio

Reports to Rules... in Record time.

Huntable CTI Studio is an open-source, agentic threat-intelligence (CTI) workbench that turns published threat reports into validated Sigma detection rules. It is built for detection engineers, threat hunters, DFIR and blue-team analysts practicing detection-as-code: it ingests OSINT from 38 seeded CTI sources, preserves complete publisher-authored Sigma directly from article text through a deterministic provenance pre-pass, and runs a 7-step LangGraph pipeline that extracts observables (command lines, process trees, registry keys, services, scheduled tasks, network indicators, hunt queries) across Windows, Linux, and macOS. Generated rules are de-duplicated against 3,000+ SigmaHQ community rules before human review; source-provided rules retain exact YAML, attribution, license evidence, and delivery controls. Everything runs locally in Docker, exposes a Model Context Protocol (MCP) server for AI agents, and works with the LLM provider you choose.

Who Is This For?

Role	What you get
Detection Engineers	Auto-generated Sigma rules from CTI articles, validated and de-duplicated against SigmaHQ
Threat Hunters	Extracted command-lines, process trees, and hunt queries ready for triage
SOC Analysts	Curated, scored intelligence feed with semantic search via MCP
Contributors and agents	A Docker-first stack with explicit workflow, config, and persistence contracts

Highlights

• Multi-source aggregation — RSS feeds, direct scrape endpoints, and browser extension
• Agentic workflows - deterministic source-Sigma import, then Platform Detection -> junk filter -> ranking -> extraction -> Sigma generation -> similarity -> queue promotion; platform-aware routing skips Windows-only extractors for Linux/macOS articles
• Publisher-authored Sigma provenance - exact source YAML, attribution, license evidence, immutable review records, and fail-closed delivery policy (contract)
• Detection support — validation, similarity matching, and coverage classification
• Storage & services — FastAPI web app, PostgreSQL + pgvector, Redis, Celery worker/scheduler
• Search & MCP retrieval — Semantic search across collected intelligence; conversational retrieval via the Huntable MCP server
• MCP (optional) — Model Context Protocol server with read tools plus scoped, audited write tools; committed .mcp.json wires it up for project-aware clients with no setup (same env as the web app; tool reference)

Links

• Landing page: https://huntable.io
• Documentation site: https://dfirtnt.github.io/Huntable-CTI-Studio/
• Introductory blog post: https://dfirtnt.wordpress.com/2026/02/04/introducing-huntable-cti-studio/
• Source and issues: https://github.com/dfirtnt/Huntable-CTI-Studio

** SECURITY WARNING **

!! The DEFAULT mode is UNAUTHENTICATED (AUTH_MODE=disabled) -- intended for research, learning, and automation on a trusted/local network. DO NOT expose the default mode to a hostile network.

For hardened deployments, an optional enterprise boundary is available: SSO through a trusted-header reverse proxy (Google / GitHub / Microsoft), role-based access control, CSRF protection, fail-closed production startup, and a redacted, actor-attributed audit trail. See Authentication and Enterprise SSO Setup.

Even when hardened, the phase-one audit log is database-backed and mutable by database administrators (forward exports to a SIEM for higher assurance), and the app is not intended to store classified or proprietary threat intelligence at this time.

Huntable CTI Studio v7.9.0 "Europa" - A Cyber Threat Intelligence ML/AI workbench that automates collection, extraction, and detection rule generation from 38 seeded OSINT sources (see config/sources.yaml; runtime may add or replace rows after DB sync).

Purpose

Aggregates cybersecurity threat intelligence from RSS feeds and web scraping; uses regex and AI to score relevance and extract observables; generates SIGMA detection rules, and prevents duplicates through jaccard similarity matching against 3,000+ community rules. Novelty is scored as a weighted behavioral similarity: 70% atom Jaccard overlap plus 30% detection-logic shape, so a rule is flagged as a duplicate for what it detects, not how its YAML happens to be written. More details here: https://dfirtnt.wordpress.com/2026/02/04/introducing-huntable-cti-studio/

Architecture

• 8 default services: PostgreSQL (pgvector), Redis, FastAPI web app, maintenance runtime, Celery workers (default + workflow), scheduler, and a one-shot Codex auth initializer
• LangGraph: Orchestrates a deterministic source-Sigma pre-pass followed by the 7-step agentic workflow with conditional early-exit gates; execution state is persisted to dedicated Postgres tables
• Database-backed workflows: Articles, workflow executions, Sigma rules, presets, settings, evals, and supporting metadata
• Source healing: operator-invoked Claude Code skill diagnoses failing sources (RSS inspection, sitemap discovery, JS-rendering detection, WP JSON API probing) and proposes a config fix for approval — never auto-applies, never runs on a schedule
• Multi-model AI: OpenAI and Anthropic, an optional local LM Studio provider, and an optional subscription-backed Codex provider for workflows

Agentic Workflow

The main engine is a LangGraph-based workflow executed by Celery workers:

Pre-pass: Source Sigma Import - Scan articles.content without an LLM, preserve complete publisher-authored Sigma exactly, and record provenance and delivery eligibility.

1. Platform Detection — Platform classification for capability-based extractor routing
2. Junk Filter — Conservative content filtering
3. LLM Rank — Relevance scoring
4. Extract Agent — Extract observables (command-line, process trees, network indicators, hunt queries, and Windows-specific artifacts)
5. Generate SIGMA — Create detection rules with iterative validation
6. Similarity Search — Compare against indexed Sigma rules using behavioral similarity
7. Promote to Queue — Queue novel rules for human review and PR submission

Quick Start

Requirements: Docker + Docker Compose

git clone https://github.com/dfirtnt/Huntable-CTI-Studio.git
cd Huntable-CTI-Studio
./setup.sh --no-backups
./start.sh

Access:

• Web UI: http://localhost:8001
• API Docs: http://localhost:8001/docs
• Docs site: http://localhost:8000
• Health: curl http://localhost:8001/health
• CLI: ./run_cli.sh <command>

MCP (optional)

MCP server for agents (articles, sources, SIGMA, workflow tools), with read tools plus scoped, audited write tools. Requires app env/DB as for the web app.

Tool reference: docs/reference/mcp-tools.md (get_article uses Article ID from search output, not list position).

Connecting an MCP client (Claude Code, Claude Desktop, Cursor, …): the repo ships a committed .mcp.json that points at scripts/run_mcp_server.sh. Clients that read project .mcp.json (e.g. Claude Code in this directory) need no setup — approve the huntable-cti-studio server when prompted. For other clients, register bash scripts/run_mcp_server.sh as the command. The launcher runs the server inside the Docker cli service, so it works regardless of cwd or shell state — and semantic search works on every platform (including Intel Mac, whose host venv can't load the torch/sentence-transformers embedding model). Docker must be running.

Run it by hand (debugging) — same launcher the .mcp.json uses:

bash scripts/run_mcp_server.sh     # runs the server in the Docker cli container

For Coding Agents And Contributors

If you need to get oriented quickly, read these first:

1. AGENTS.md
2. docs/development/agent-orientation.md
3. docs/architecture/workflow-data-flow.md
4. docs/development/testing.md
5. config/presets/AgentConfigs/README.md

Runtime entry points worth opening early:

• src/web/modern_main.py
• src/web/routes/__init__.py
• src/workflows/agentic_workflow.py
• src/worker/celery_app.py
• src/config/workflow_config_schema.py
• run_tests.py

Documentation

The documentation is organized under /docs and is published with MkDocs Material at https://dfirtnt.github.io/Huntable-CTI-Studio/.

• Start here: docs/index.md
• Quickstart: docs/quickstart.md
• Architecture: docs/architecture/overview.md, docs/architecture/workflow-data-flow.md
• Development: docs/development/setup.md, docs/development/testing.md
• Reference: docs/reference/api.md, docs/reference/schemas.md, docs/reference/mcp-tools.md
• Security & Auth: docs/guides/authentication.md, docs/guides/enterprise-sso.md

License

MIT License — see LICENSE for details.