Your files stay on your device

Threat intelligence report builder

Fill in a structured threat report form and export Markdown, HTML, or JSON locally, with sensitive-information review before any export unlocks.

2. Executive section

Executive summaryWhat happened, why it matters, what you recommend, in plain language

Key judgementsEach with an explicit confidence

Overall confidence

Scope and period covered

3. Technical section

Sources with Admiralty grading (A to F reliability, 1 to 6 credibility)

Timeline in UTC

TTPs mapped to MITRE ATT&CK

Indicators, one per lineIPv4, IPv6, domain, URL, email, MD5, SHA-1, or SHA-256; validated and normalised

Defang indicators in exported reports

Affected assets, one per line

Mitigations and recommended actions, one per line

Assessment

Limitations and intelligence gaps

4. Review and export

Exports are locked

Run the review once per finished draft. It checks the prose for secret-shaped text and unlocks Markdown, HTML, and JSON exports for this exact content.

Export buttons unlock after the review passes on this content.

Everything runs in this tab: nothing is uploaded, and no report is stored anywhere. TLP labels follow FIRST 2.0. The builder does not ship the MITRE ATT&CK catalog, so technique names and contexts are yours to type; it checks only that the id is shaped like T1566 or T1566.001. The HTML export is self-contained, escapes every value, and carries a script-blocking content security policy so quoted strings cannot execute in a reader's browser.

All text tools

Was this tool useful?

Threat intelligence report builder

More text tools