Statecraft Cyber Intelligence

Threat intelligence platform in Portuguese built from scratch as a personal Blue Team project. It aggregates data from global open sources and turns it into technical briefings, classified news, enriched CVEs, and structured IOCs — all in PT-BR, continuously updated.

Site: statecraftcyber.vercel.app

---

What the platform offers

• Threat Briefings — AI-generated technical reports (Groq / LLaMA 3.3 70B) every hour, with severity, IOCs, CVEs, and direct recommendations for the Blue Team
• CVEs — vulnerabilities from the last 72h with CVSS, EPSS, CISA KEV, and classification by type (Code Execution, Injection, Buffer Overflow, etc.)
• News — 20 RSS feeds from international and Brazilian sources (CISA, Krebs, Google Threat Intelligence, CERT.br, WeLiveSecurity Brasil, and others), classified by threat type and region. When the user opens an article, the Statecraft AI enriches the content on demand, generating a complete journalistic piece in PT-BR. The result is cached in NewsCache to serve subsequent reads without a new LLM call
• IOC Search — search for indicators of compromise extracted from briefings, with support for IP, domain, hash, URL, and email
• Health Endpoint — /api/health for availability and database integrity monitoring
• About — technical context of the platform and the data pipeline

---

Stack

Layer	Technology
Frontend / Backend	Next.js 16.2.6 (App Router), TypeScript, Tailwind CSS v4
Database	PostgreSQL (Neon) + Prisma 6
AI	Groq API (LLaMA 3.3 70B)
Sanitization	isomorphic-dompurify + marked
Threat sources	NVD API, CISA KEV, OTX AlienVault, EPSS (FIRST.org)
News feeds	20 international and Brazilian RSS sources
Deploy	Vercel (app) + cron-job.org (external hourly scheduler, Hobby plan)

---

Architecture and Data Pipeline

External sources (NVD, CISA KEV, OTX, RSS)
        │
        ▼
  cron-job.org → Vercel — runs every hour (Hobby plan)
  vercel.json defines the schedule for future migration to the Pro plan
        │
        ├── Collects news (RSS feeds) → NewsCache (PostgreSQL)
        │
        └── Collects threats (NVD, CISA, OTX)
                │
                ▼
          Groq LLaMA 3.3 70B
          Generates structured briefing (title, summary,
          severity, IOCs, CVEs, MITRE ATT&CK)
                │
                ▼
          Briefing → PostgreSQL (status: published)
                │
                ├── Structured IOCs → Ioc table
                └── Exposed via REST API → Frontend (Next.js)

---

Prisma Models

Model	Description
Briefing	Complete AI-generated briefing with threat metadata
Ioc	Normalized indicators of compromise with indexes
NewsCache	Enriched news from RSS feeds
CronLog	Execution log of cron jobs

---

Local setup

Prerequisites

• Node.js 20+
• PostgreSQL (or a free Neon account)
• API keys: Groq, NVD (optional), OTX (optional)

Installation

git clone https://github.com/ptkthg/statecraftcyber
cd statecraftcyber
npm install

Environment variables

Copy the example file and fill in the variables:

cp .env.example .env

Variable	Description
DATABASE_URL	PostgreSQL connection URL with ?sslmode=require
GROQ_API_KEY	Groq API key (groq.com)
NVD_API_KEY	NVD API key — optional, without a key the rate limit is lower
OTX_API_KEY	AlienVault OTX key — optional
CRON_SECRET	Secret token to authenticate cron calls (header Authorization: Bearer)
ADMIN_SECRET	Access password for the /admin/status panel
AUTO_PUBLISH	true to publish briefings automatically
MAX_HOURLY_BRIEFINGS	Limit of briefings per hour (default: 3)

Database

# Create tables and apply migrations
npx prisma migrate dev

# View data in the browser
npx prisma studio

Development

npm run dev

Access http://localhost:3000.

Production build

npm run build
npm start

---

Useful Prisma commands

# Apply migrations in production (without generating migration files)
npx prisma migrate deploy

# Regenerate the Prisma Client after schema changes
npx prisma generate

# Reset database (WARNING: deletes all data)
npx prisma migrate reset

---

Data sources

Source	Type	Endpoint
NVD (NIST)	CVEs	services.nvd.nist.gov/rest/json/cves/2.0
CISA KEV	Exploited vulnerabilities	www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
EPSS (FIRST.org)	Exploitation score	api.first.org/data/v1/epss
AlienVault OTX	IOCs and pulses	otx.alienvault.com/api/v1
20x RSS feeds	News	CISA, Google Threat Intelligence, Cisco Talos, CERT.br, Elastic Security Labs, and others

---

Notice

Threat Intelligence data must be validated against primary sources before any critical action in production.

---

Developed by Patrick Santos — Security Analyst, Blue Team.