BRIEFR

Self-hosted CVE intelligence and detection engineering

What is BRIEFR? · Screenshots · Getting started · Docs · License

What is BRIEFR?

BRIEFR is a self-hosted CVE intelligence platform. It pulls vulnerability data from public and community sources — NVD, CISA KEV, EPSS, MITRE ATT&CK/ATLAS, OTX, abuse.ch, exploit indexes, RSS news — into a local PostgreSQL database and gives you a single UI to work through it: a daily brief, a searchable feed, IOC lookup, and detection rule generation.

Why BRIEFR?

The public feeds are just the input; they're not really the point. BRIEFR's value is what it does with them: rule-based prioritization (Operational Priority P1–P4, threat score, environment relevance, SSVC), correlation that shows why CVEs are related (campaigns, shared infrastructure, actor/sector, timing), and Sigma / YARA / SIEM rule generation from a local SigmaHQ mirror. Everything is deterministic and documented — no black-box model. LLMs are optional and only narrate at the edges.

The five tabs cover the workflow: BRIEF (morning queue), FEED (CVE list and search), IOC LOOKUP, INCIDENTS & NEWS, and FORGE (ATT&CK navigator, hunt packs).

Some boundaries, so you know what you're getting: BRIEFR is not a scanner or ASM tool — it prioritizes known CVEs, it doesn't find your assets. Stack matching is term-based, not SBOM-precise. Community attribution is labeled as such. Data is as fresh as each upstream feed allows, and BRIEFR syncs on a schedule that respects that feed's rate limits; nothing is real-time. One instance, self-hosted: your hardware, your data.

Stack: FastAPI · React 19 · PostgreSQL 16 (+ pgvector for embeddings) · APScheduler. Bring your own API keys for upstream feeds.

Apache 2.0: clone, self-host, modify, and use commercially with attribution (LICENSE, NOTICE).

Try it

• Live demo — briefrdemo.projectjupiter.in, 1:1 analyst UI with fixture data, no install and no backend.
• Self-host — docs/SELF_HOST.md, install your own PostgreSQL-backed deployment.
• Documentation — docs.projectjupiter.in.

The demo is a static showroom (briefr-demo): the same shell as production over frozen JSON instead of a database. Forge, hunt-pack generation, and IOC enrichment are visual-only there.

Screenshots

Screenshots from a self-hosted PostgreSQL deployment.

Getting started

Install guide: docs/SELF_HOST.md

Try BRIEFR locally

git clone https://github.com/Soldier0x0/briefr.git
cd briefr/backend
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements-dev.txt
cp .env.example .env
uvicorn main:app --host 0.0.0.0 --port 8000

cd ../frontend && npm install && npm run dev   # http://localhost:5173

Open http://localhost:5173 — first-run setup creates the admin user.

Production install (PostgreSQL + nginx)

For a permanent system, use SELF_HOST §3: provision pgvector/pgvector:pg16, then bash deploy/briefr-install.sh (or deploy/setup.sh). That runs npm run build, configures systemd + nginx, and serves the built SPA.

curl -s http://127.0.0.1:8000/api/health | python3 -m json.tool

Documentation

Index: docs/index.md

API

Full catalog: docs/API_REFERENCE.md. Interactive Swagger at http://localhost:8000/api/docs (enabled only in development — BRIEFR_ENV=development; production disables it).

Environment variables: backend/.env.example

License

Apache License 2.0 — see LICENSE. Contributions: CONTRIBUTING.md. Security reports: SECURITY.md (no public issues for vulnerabilities).

Copyright © 2026 Sai Harsha Vardhan.