ORACLE

Threat intelligence platform with IOC management, APT tracking, and STIX 2.1 visualization.

Part of the Darknode cybersecurity education platform.

Screenshot coming soon

Features

ORACLE is a browser-based threat intelligence platform built entirely in vanilla JavaScript. It teaches intelligence analysis, indicator management, and adversary tracking through interactive, data-rich scenarios.

7 Intelligence Tabs

• Intel Dashboard -- Threat landscape overview with active campaigns, top threat actors, trending IOCs, and regional attribution map
• IOC Manager -- Add, import, search, and manage indicators of compromise (IP, domain, hash, URL, email, CVE) with CSV/JSON import/export
• Threat Actors -- 30 APT group profiles with aliases, nation-state attribution, MITRE ATT&CK TTPs, target sectors, and notable campaigns
• Campaign Tracker -- Link IOCs to campaigns with timeline view, Diamond Model analysis (Adversary, Infrastructure, Capability, Victim), and Kill Chain mapping
• STIX Viewer -- Parse STIX 2.1 JSON bundles and render interactive relationship graphs with draggable SVG nodes and object inspector
• Feed Aggregator -- Live threat feeds from 5 sources (CISA KEV, ThreatFox, URLhaus, and more) with auto-correlation against the IOC database
• Reports -- Generate 4 report types (Executive Brief, Technical Analysis, IOC Report, Campaign Report) with JSON export

Key Capabilities

• 30 APT group profiles with accurate TTPs, aliases, and MITRE ATT&CK technique IDs
• 105 sample IOCs across 7 types (IP, domain, MD5, SHA256, URL, email, CVE)
• 12 campaign records with Diamond Model and Kill Chain visualization
• STIX 2.1 parser with 28-object sample bundle and 14 relationships
• Interactive SVG relationship graph with draggable nodes
• Bulk CSV import and JSON/CSV export for IOC data
• Inline CSS with full theme support (classic, pro-light, pro-dark)
• ES module with renderOracle(container) and cleanupOracle() exports
• Zero external dependencies

Usage

ORACLE is designed to run inside the Darknode web platform. It can also be imported as a standalone ES module:

import { renderOracle, cleanupOracle } from './oracle.js';
renderOracle(document.getElementById('app'));

License

MIT -- see LICENSE for details.

---

Built by Darknode