Current source release: v6.5.0, merged and CI-validated 25 July 2026. Latest published immutable release: v6.0.0, published . AdversaryGraph was formerly named ThreatMapper.
A self-hosted analyst workbench for turning reports, logs, IOCs, malware findings, asset inventories, and ATT&CK knowledge into mapped techniques, investigation context, detection gaps, validation scenarios, observability, and report-ready outputs.
These capabilities are included in the merged, CI-validated AdversaryGraph v6.5.0 source release. They are absent from the historical v6.0.0 tag; immutable v6.5 release publication is still pending.
Search 12 indexed source types: ATT&CK techniques, groups, and campaigns; actor intelligence; IOCs; CVEs; analysis reports; knowledge; threat signals; threat hunts; evidence nodes; and assets. Exact matching and PostgreSQL full-text search are the default. Operators can optionally add embeddings through a private model endpoint and pgvector.
Grounded answers cite indexed evidence. Navigator output remains a checksum-bound proposal that
is persisted as an expiring advisory record and requires analyst confirmation; it does not save or
apply a named layer automatically. The stdio-only MCP
server exposes exactly four tools: search_intelligence, ask_intelligence,
get_indexed_entity, and propose_navigator_layer.
read. Profile listing, search, entity and provider reads, assistance, and
proposal confirmation use run_analysis. Profile administration uses
manage_intel; reindexing and index-run review use manage_feeds. MCP inherits
the deployment API token, authorization, and data visibility boundaries.
AdversaryGraph connects CTI extraction, IOC enrichment, ATT&CK mapping, malware analysis, asset exposure, attack simulation, and detection validation into one workflow.
Reports, logs, IOCs, malware findings, asset inventory, or feed data.
Extract ATT&CK candidates with evidence and analyst review gates.
Pivot through IOC sources, actor context, campaigns, sectors, and references.
Review detection gaps, run lab simulations, and forward telemetry to SIEM.
Export investigation summaries, matrices, layers, and analyst handoff output.
AdversaryGraph now documents the evidence reviewers and buyers need: architecture, validation examples, security scanning, enterprise access guidance, public roadmap, and comparisons with established CTI and detection tools.
Runtime, evidence model, correlation model, Attack Simulation, Malware Analysis, and observability diagrams.
Architecture diagramsScreenshot-backed case studies for logs-to-report, SIEM validation, CVE correlation, auth/admin, and malware analysis.
Validation examplesPublic plan covering work after the v6.5 source boundary, Windows telemetry direction, broader simulation coverage, and integrations.
RoadmapClear fit against OpenCTI, MISP, ATT&CK Navigator, Atomic Red Team, and malware sandboxes.
Compare toolsThe platform is organized around real analyst tasks, not a single visualization.
Analyze reports and telemetry with Claude, OpenAI, Gemini, MiniMax, or local OpenAI-compatible providers. Keep extracted TTPs tied to evidence and confidence.
Explore Enterprise, Mobile, ICS, and ATLAS matrices. Compare selected TTPs against groups, campaigns, reports, and saved layers.
Pivot on IPs, domains, URLs, hashes, and observables. Combine reputation, DNS, graph relationships, source conflicts, and ATT&CK leads.
Use the MalwareGraph-backed workflow for Windows sample triage: hashes, PE metadata, strings, unpacking, decompilation views, debug workspaces, and AI summaries.
Upload inventories, normalize exposed assets, score risk, propose likely entry points, and map asset-driven ATT&CK candidates for validation.
Select TTPs, run approved lab scenarios, view target-side logs, forward telemetry to a SIEM, and generate coherent AI-assisted attack-chain drills.
Review API health, request traces, route metrics, redacted logs, Prometheus output, SAST, dependency audit, secret scan, and container scan coverage.
Protect private deployments with native login, expanded RBAC, per-user permissions, session revocation, MFA workflow support, audit history, and trusted proxy SSO metadata.
Sync ATT&CK, ATLAS, ThreatFox, Malpedia, OTX, OpenCTI, STIX/TAXII, MISP JSON, custom IOC feeds, Sigma/YARA, and sandbox behavior sources.
Turn selected evidence, IOCs, actor context, technique mappings, similarity analysis, and validation notes into analyst-ready reports.
Run the full platform locally or in controlled infrastructure with Docker, private LLM gateways, local data stores, API workflows, and startup self-tests.
Current v6 captures use sanitized, deterministic API fixtures for reproducibility; older captures document historical product surfaces. They demonstrate UI behavior, not external deployment or detection-efficacy claims.
Links that verify the project, release, documentation, and platform surface.
AdversaryGraph is practical infrastructure for teams that need repeatable CTI-to-detection work.
Map reports, compare actors, track campaigns, pivot on IOCs, and prepare evidence-backed intelligence products.
Turn ATT&CK mappings into validation plans, SIEM telemetry tests, parser checks, and detection backlog items.
Connect sample triage, strings, imports, behaviors, and family leads back to ATT&CK and IOC workflows.
Move from raw logs and suspicious artifacts to enriched context, matrix views, actor hypotheses, and reports.
Send a bug report, feature request, or short note with hardened client-side validation. Text is sanitized before it is copied, opened as a direct email draft, or opened as a GitHub issue that triggers repository notifications. Screenshots are validated locally and are not uploaded by this static page.
Start with the public workspace, then deploy the self-hosted version when you need private reports, local IOC feeds, configured LLM providers, malware-analysis workflows, and SIEM validation.
Discover dashboardClick anywhere to close
ATT&CK Navigator matrixClick anywhere to close
AI-assisted report analysisClick anywhere to close
IOC InvestigationClick anywhere to close
Malware Analysis moduleClick anywhere to close
Historical v5 Attack Simulation chain-graph screenshotClick anywhere to close
SIEM forwarding configurationClick anywhere to close