MANTIS

MANTIS stands for Multi-source Analysis and Threat Intelligence Search. MANTIS is a threat intelligence workbench for IOC enrichment, OSINT CTI collection, ransomware and breach monitoring, YARA operations, malware similarity analysis, and AI-assisted investigations.

Highlights

• IOC Search: Auto-detect or manually search hashes, domains, IPs, URLs, keywords, and infrastructure targets.
• MANTIS AI: Evidence-aware chat, summaries, pivot recommendations, autonomous agent mode, AEAD case workflow, attribution scoring, correlation analysis, YARA assistance, CTI summaries, and report exports.
• Infrastructure Hunting (Infra Hunt & C2 Catalog): Pivot from any seed (IP, domain, ASN, CIDR, cert SHA-256) into adversary infrastructure. Extracts JA4/JARM, TLS certificates, favicon MMH3, and HTTP headers; cross-references 1,000+ curated C2 playbooks (Cobalt Strike, Sliver, Havoc, Metasploit, etc.); correlates across Shodan, Censys, FOFA, Netlas, URLScan, Silent Push, Driftnet, Validin, and Etugen; scores candidates with GreyNoise anti-noise verification, interactive graph visualization, and scheduled recurrence.
• AI Binary Analysis Lab: Native (PE, ELF, Mach-O) and managed .NET reverse engineering, dual headless IDA Pro and Ghidra backends, GoReSym symbol recovery, automated function/variable renaming, offline AI workspace export, autonomous in-database investigation, multi-format reporting (HTML, MD, PDF), and 1-click MANTIS case creation.
• VirusTotal Bulk Samples Downloader: Batch download malware binaries by MD5, SHA-1, or SHA-256 (up to 50 hashes) directly to local folders via browser File System Access API or create password-protected AES-256 encrypted ZIPs (infected), integrated with VT Live Hunt monitoring.
• Threat Knowledge: Browse MISP Galaxy threat actors, malware/tools, ransomware, Microsoft Activity Groups, Tidal groups, surveillance vendors, Malpedia families, and Kaspersky TIP actor profiles.
• MISP Intelligence: Query a configured MISP instance as a passive, read-only contextual correlation source for IOC events, tags, galaxies, sightings, warning lists, reports, and related indicators.
• Ransomware Monitor: Track recent victims, groups, trends, countries, ransom notes, crypto addresses, infrastructure, and watchlists from RansomLook, Ransomware.live, and ThreatLabz notes.
• YARA Ecosystem: Explore local YARA repositories, scan samples, validate rules, run corpus/path/upload tests, save workbench rules, and use AI to explain or fix rules.
• Similarity Engine: Build entities from samples, extract static and optional IDA/Hex-Rays features, compare samples, inspect functions/blocks/API patterns, and tune thresholds.
• CTI Articles: Ingest RSS/CTI feeds, extract IOCs, manage categories and sources, search the local article corpus, and request AI article summaries.
• Vulnerability Intelligence: Track CVE/PoC data, CISA KEV context, trending public exploits, and OSV malicious package intelligence.
• Telegram Toolkit: Monitor Telegram channels with MTProto, parse stealer logs, track target exposure, manage bot-token investigations, and validate artifacts.
• X Monitor: Collect and filter monitored X/Twitter accounts and infosec chatter for emerging IOC and vulnerability leads.
• Breach Watcher: Aggregate DailyDarkWeb, RecentBreaches, DataBreach.watch, HaveIBeenPwned, DataBreaches.net, Infostealers Stats, and Leak-Lookup data.
• Today's Intelligence: Daily rollup of CTI articles, exploited vulnerabilities, PoCs, ransomware activity, social signals, and optional AI brief/report output.

Architecture

flowchart LR
    classDef ui fill:#172033,stroke:#5b8cff,color:#ffffff
    classDef api fill:#332612,stroke:#f2b84b,color:#fff3d1
    classDef ai fill:#311547,stroke:#b76cff,color:#ffffff
    classDef data fill:#12332c,stroke:#2bd4a3,color:#dfffee
    classDef ext fill:#291b1b,stroke:#f87171,color:#ffe5e5

    User["Analyst"]:::ui --> UI["Frontend SPA<br/>index.html, app.js, ai.js, similarity.js, binary-lab.js, infra-hunt.js"]:::ui
    UI --> Search["IOC Search<br/>auto, hash, domain, IP, URL, keyword, infra"]:::ui
    UI --> Modules["Workbenches<br/>Threat Knowledge, Infra Hunt, Binary Lab, YARA, Similarity, CTI, Ransomware, Telegram, Breach, PoC, Downloader"]:::ui
    UI --> AIPanel["MANTIS AI Panel<br/>chat, pivots, agent, report, attribution"]:::ai

    Search --> API["FastAPI backend<br/>backend/main.py"]:::api
    Modules --> API
    AIPanel --> API

    API --> Intel["intel_query.py<br/>provider adapters and normalizers"]:::api
    API --> LocalEngines["Local engines<br/>Infra Hunt, Binary Lab, YARA, CTI DB, PoC index, Similarity, Ransomware, Telegram"]:::api
    API --> AIServices["AI services<br/>ai_service, ai_case_service, ai_case_agent"]:::ai

    Intel --> Providers["External passive providers<br/>VT, OTX, MISP, ThreatFox, URLScan, Shodan, Censys, GitHub, Twitter/X, RansomLook, Ransomware.live, ORKL, etc."]:::ext
    LocalEngines --> Stores["Local data<br/>SQLite, JSON catalogs, C2 playbooks, YARA repos, RSS cache, reports"]:::data
    AIServices --> AIStores["AI memory and cases<br/>case DB, audit trail, report files"]:::data

    Providers --> API
    Stores --> API
    AIStores --> API
    API --> UI

MANTIS AI

MANTIS AI is not a generic chatbot bolted onto the UI. It reads compact page context, provider findings, current results, visible text, case state, and analyst-selected evidence. It can then reason about the active investigation while preserving passive/read-only guardrails.

AI capabilities

• Assist: Ask questions about the current result set or investigation page.
• Summarize Findings: Convert raw provider cards into concise analyst notes.
• Recommend Pivots: Rank passive follow-up actions and suppress noisy pivots.
• Compare Relationship: Correlate entities and evidence with overlap/contradiction handling.
• Attribution: Score candidate actor/group attribution with evidence categories, contradictions, missing evidence, and confidence bands.
• Agent Investigation: Run bounded autonomous next-step selection through approved frontend actions.
• AEAD Case Run: Execute Acquire, Enrich, Discover/Pivot, Analyze, and Deliver against case evidence.
• Report Drafting: Build case reports, Markdown exports, JSON exports, saved HTML reports, and portable AI workspace ZIPs.
• YARA Assistant: Explain rules, analyze validation errors, suggest fixes, auto-fix safe syntax issues, and review test results.
• CTI AI: Summarize CTI articles and produce Today's Intelligence AI briefs/reports.
• Audit and Safety: Store tool decisions, approval state, operation metadata, and suppressed pivots.

AEAD workflow

flowchart TD
    classDef ai fill:#311547,stroke:#b76cff,color:#ffffff
    classDef data fill:#12332c,stroke:#2bd4a3,color:#dfffee
    classDef guard fill:#332612,stroke:#f2b84b,color:#fff3d1
    classDef out fill:#172033,stroke:#5b8cff,color:#ffffff