Cyberbro

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple services.
🌐 demo.cyberbro.net

---

---

About

Inspired by Cybergordon and IntelOwl.

This project aims to provide a simple and efficient way to check the reputation of your observables using multiple services, without having to deploy a complex solution. Read the docs at https://docs.cyberbro.net/

[!TIP] To build custom reports, use Cyberbro with your favorite LLM (Claude, OpenAI gpt-5...) via MCP (Model Context Protocol)
Checkout Cyberbro MCP for more information.

Demo

Features

• Easy Input: Paste raw logs or IoCs-automatic parsing and extraction.
• Multi-Service Checks: Reputation lookup for IPs, hashes, domains, URLs, and Chrome extension IDs across many threat intel services.
• Comprehensive Reports: Advanced search, filtering, and export to CSV/Excel.
• Fast Processing: Multithreaded for speed.
• Automated Pivoting: Discover related domains, URLs, and IPs via reverse DNS and RDAP / Whois.
• Accurate Domain & Abuse Info: RDAP / Whois and abuse contact lookups.
• Integrations: Microsoft Defender for Endpoint, CrowdStrike, OpenCTI, Grep.App, Hudson Rock, and more.
• Proxy & Storage: Proxy support and results stored in SQLite.
• History & Graphs: Analysis history and experimental graph view.
• Cache: Caching for faster repeat lookups (enabled at multi-engines level, not each engine).

What Makes Cyberbro Unique

• Beginner-Friendly: Accessible for all skill levels.
• Chrome Extension ID Lookup: Get extension names and CTI data from IDs.
• Lightweight Deployment: Simple setup and use.
• Advanced TLD Extraction: Accurate root domain detection for better lookups.
• Pragmatic Data Gathering: Uses GitHub and Google to find overlooked IoCs.
• CTI Report Integration: Fetches IoC-related reports from IoC.One.
• EDR Integration: Checks observables against your own security tools (MDE, CrowdStrike).

Getting Started - TL;DR

[!TIP] If you are lazy, you need Docker.
Do a git clone ; copy .env.sample to .env ; docker compose up then go to localhost:5000. Yep, that's it!

Getting Started

• To get started, clone the repository

git clone https://github.com/stanfrbd/cyberbro
cd cyberbro

Edit the config file (mandatory)

cp .env.sample .env

[!NOTE] Don't have API keys? No problem, just copy .env.sample to .env and leave optional values empty. Be careful if a proxy is used.
You will be able to use all free engines!

• Fill values (including proxy if needed) in the .env file.

[!WARNING] .env contains sensitive secrets and must never be committed. For production/team deployments, use SOPS, Vault, or an equivalent secret manager workflow.

ABUSEIPDB=token_here
ALIENVAULT=token_here
CRIMINALIP_API_KEY=token_here
CROWDSTRIKE_CLIENT_ID=client_id_here
CROWDSTRIKE_CLIENT_SECRET=client_secret_here
DFIR_IRIS_API_KEY=token_here
DFIR_IRIS_URL=https://dfir-iris.local
DFIR_IRIS_SEARCH_NOTES=false
GOOGLE_CSE_CX=cx_here
GOOGLE_CSE_KEY=key_here
GOOGLE_CSE_URL=https://www.googleapis.com/customsearch/v1
GOOGLE_SAFE_BROWSING=token_here
HISTER_TOKEN=token_here
HISTER_BASE_URL=https://hister.example.com
IPAPI=token_here
IPINFO=token_here
MDE_CLIENT_ID=client_id_here
MDE_CLIENT_SECRET=client_secret_here
MDE_TENANT_ID=tenant_here
MISP_API_KEY=token_here
MISP_URL=https://misp.local
MISP_FEEDBACK_SERVER_URL=https://misp-feedback.local
MISP_FEEDBACK_TOKEN=token_here
OPENCTI_API_KEY=token_here
OPENCTI_URL=https://demo.opencti.io
PROXY_URL=
RANSOMWARE_LIVE_API_KEY=token_here
RL_ANALYZE_API_KEY=token_here
RL_ANALYZE_URL=https://spectra_analyse_url_here
ROSTI_API_KEY=token_here
SHODAN=token_here
SPUR_US=token_here
THREATFOX=token_here
VIRUSTOTAL=token_here
WEBSCOUT=token_here

[!IMPORTANT] Starting with version v0.13.0, Cyberbro no longer supports secrets.json and the /config page. Cf. discussion 165.
If you already have a legacy secrets.json, convert it to .env with: python3 scripts/secrets_json_to_env.py

See Advanced options for deployment in the docs.

Launch the app

Lazy and easy - use docker

[!WARNING] Make sure you install the compose plugin as docker compose and not docker-compose. In Docker, the app binds to 0.0.0.0 inside the container even if your local .env sets FLASK_HOST=127.0.0.1.

docker compose up # use -d to run in background and use --build to rebuild the image

• Go to http://127.0.0.1:5000 and Enjoy.

Don't forget to edit .env before building the image.

See Advanced options for deployment in the docs to get all Docker deployment options.

The old way

• Clone the repository and install the requirements.

You might want to create a venv before installing the dependencies.

pip install -r requirements.txt

• Run the app with gunicorn (clean mode).

gunicorn -c prod/gunicorn.conf.py app:app

• Run the app with in development mode.

python3 app.py

Screenshots

See all screenshots