Statecraft Cyber Intelligence

Threat intelligence platform in Portuguese built from scratch as a personal Blue Team project. It aggregates data from global open sources and transforms it into technical briefings, classified news, enriched CVEs, and structured IOCs — all in PT-BR, continuously updated.

Site: statecraftcyber.vercel.app

What the platform offers

• Threat Briefings — technical sheets generated by AI (Groq / LLaMA 3.3 70B) every hour, with severity, IOCs, CVEs, and direct recommendations for the Blue Team
• CVEs — vulnerabilities from the last 72 hours with CVSS, EPSS, CISA KEV, and classification by type (Code Execution, Injection, Buffer Overflow, etc.)
• News — 19 RSS feeds from global sources (CISA, Krebs, The Hacker News, CERT.br, SANS ISC, and others), classified by threat type and region. When the user opens an article, the Statecraft AI enriches the content on demand, generating a full journalistic article in PT-BR. The result is cached in NewsCache to serve subsequent reads without a new LLM call
• IOC Search — search for indicators of compromise extracted from briefings, with support for IP, domain, hash, URL, and email
• Health Endpoint — /api/health for monitoring availability and database integrity
• About — technical context of the platform and data pipeline

Stack

Architecture and Data Pipeline

External sources (NVD, CISA KEV, OTX, RSS)
        │
        ▼
  cron-job.org → Vercel — runs every hour (Hobby plan)
  vercel.json defines the schedule for future migration to Pro plan
        │
        ├── Collects news (RSS feeds) → NewsCache (PostgreSQL)
        │
        └── Collects threats (NVD, CISA, OTX)
                │
                ▼
          Groq LLaMA 3.3 70B
          Generates structured briefing (title, summary,
          severity, IOCs, CVEs, MITRE ATT&CK)
                │
                ▼
          Briefing → PostgreSQL (status: published)
                │
                ├── Structured IOCs → Ioc table
                └── Exposed via REST API → Frontend (Next.js)

Prisma Models

Local setup

Prerequisites

• Node.js 20+
• PostgreSQL (or free Neon account)
• API keys: Groq, NVD (optional), OTX (optional)

Installation

git clone https://github.com/ptkthg/statecraftcyber
cd statecraftcyber
npm install

Environment variables

Copy the example file and fill in the variables:

cp .env.example .env

Database

# Create tables and apply migrations
npx prisma migrate dev

# View data in browser
npx prisma studio

Development

npm run dev

Access http://localhost:3000.

Production build

npm run build
npm start

Useful Prisma commands

# Apply migrations in production (without generating migration files)
npx prisma migrate deploy

# Regenerate Prisma Client after schema changes
npx prisma generate

# Reset database (CAUTION: deletes all data)
npx prisma migrate reset

Data sources

Disclaimer

Threat Intelligence data must be validated against primary sources before any critical action in production.

Developed by Patrick Santos — Security Analyst, Blue Team.