对手图谱

Prerequisites

• Docker + Docker Compose (v2)
• API key for at least one cloud LLM provider, or a local OpenAI-compatible LLM endpoint

Deployment

Quick Start

Usage Guide

Public Demo Privacy Note

The public Web workspace is intended for exploration. Do not upload confidential, customer-sensitive, classified, or internal reports into public demos or third-party environments. Use the self-hosted Docker deployment for private analysis.

Screenshots And Visual Evidence

Screenshot evidence is preserved in docs/screenshots/. The set covers the public ATT&CK matrix workspace, group overlay workflows, analysis views, report/evidence review, and ecosystem navigation from the companion walkthrough.

Demo workflow video: DFIR report download to AI analysis and comparison shows the end-to-end flow from indexed public report examples to local PDF upload, streamed ATT&CK extraction, and selected TTP review. A GIF version is also available at docs/demo-videos/dfir-report-ai-analysis-compare.gif.

---

1 — Clone and configure

git clone https://github.com/anpa1200/adversarygraph.git
cd adversarygraph
cp .env.example .env

Edit .env and add your API keys:

```env

Optional cloud providers

ANTHROPIC_API_KEY=sk-ant-... OPENAI_API_KEY=sk-... OPENAI_MODEL=gpt-4.1 GEMINI_API_KEY=AIza...

Optional local provider: Ollama / LM Studio / LocalAI / vLLM with OpenAI-compatible API

LOCAL_LLM_BASE_URL=http://host.docker.internal:11434/v1 LOCAL_LLM_API_KEY=local LOCAL_LLM_MODEL=llama3.1:8b

Configuration

All configuration is via environment variables in .env.

To ingest only Enterprise (faster first start):

ATTCK_DOMAINS=enterprise-attack

---

Reference Book and Exact TTP Crosslinks

AdversaryGraph integrates the complete Anomaly Detection Atlas as an autonomous Docker service. Click Reference Book in the sidebar to open the full documentation site.

Each matrix technique panel loads ttp-reference-index.json and shows links only to exact matching paragraphs or table rows. A technique can link to multiple relevant activity descriptions, basic detection rules, and statistical-anomaly mappings. The links use stable generated anchors such as:

http://localhost:3001/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#ttp-t1059-001
http://localhost:3001/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#ttp-t1030

The embedded snapshot makes the book usable without a successful remote synchronization. The atlas-builder service checks the standalone atlas repository every hour, regenerates exact TTP anchors and the crosslink index, then atomically publishes the updated Docusaurus build.

Manual local synchronization:

make sync-atlas
docker compose up -d --build atlas-builder atlas-docs frontend

---

Via API

curl -X POST http://localhost:8000/api/sync/trigger

DB 1 — MITRE ATT&CK (read-only reference data)

Populated from MITRE's official STIX 2.1 bundles on startup and on each sync. Contains:

• Groups — named threat actors with aggregate TTP profiles from the ingested release
• Campaigns — named operations with per-operation TTP profiles from the ingested release
• Attribution links — which group conducted which campaign (attributed-to relationships)
• Technique usage — the specific techniques observed in each group/campaign with use descriptions

Built on the currently ingested MITRE ATT&CK and MITRE ATLAS datasets. Counts depend on the selected domain and source release.

API Reference

Full interactive documentation at http://localhost:8000/docs.

Registered route groups include:

Inside the api container (real PostgreSQL):

docker compose exec api pytest tests/ -v

Web vs Docker

AdversaryGraph Web is the public browser-native workspace for ATT&CK exploration, manual layers, group overlays and comparisons, local workspaces, ecosystem research, coverage-gap analysis, and browser-generated exports. It does not perform LLM report extraction or backend private-report storage.

AdversaryGraph Docker is the full self-hosted platform for provider-configured AI extraction, private PostgreSQL-backed analyses, campaigns, APIs, PDF reports, detection-rule workflows, and scheduled ATT&CK synchronization.

AdversaryGraph is self-hosted. In Docker mode, report content is sent only to the LLM provider configured by the operator. For fully private analysis, use a local or private LLM gateway. The public Web workspace does not perform LLM report extraction or backend report storage.

The Docker deployment gives the operator control over storage, networking, and provider configuration. Trusted-header authentication and roles are available when configured, but internet-facing deployments still require TLS, an authenticating reverse proxy, restricted network exposure, backups, retention controls, and secrets management.

┌──────────────────────────────────────────────────────────────────┐
│                         Docker Compose                           │
├────────────────┬───────────────┬──────────────┬─────────────────┤
│  React / Vite  │   FastAPI     │  PostgreSQL  │  Redis + Celery │
│  (port 3000)   │  (port 8000)  │     16       │  worker + beat  │
│                │               │              │                 │
│  Vite proxy    │  SQLAlchemy   │  DB 1: ATT&CK│  daily MITRE    │
│  /api → :8000  │  async ORM    │  DB 2: Reports  sync job       │
└────────────────┴───────────────┴──────────────┴─────────────────┘

Backend — Python 3.12, FastAPI, SQLAlchemy 2.x (async), Celery Frontend — React 18, TypeScript, Vite, D3.js, Tailwind CSS, Zustand Database — PostgreSQL 16 with JSONB for ATT&CK STIX data Queue — Redis + Celery (daily MITRE sync at 03:00 UTC)

Compare

Rank ATT&CK groups and campaigns against your TTPs using Jaccard similarity.

Jaccard similarity = |shared techniques| / |union of all techniques|

Use the mode switcher at the top of the Compare page to choose what to compare against:

Mode: Groups (DB 1)

Rank every ATT&CK group against your current Navigator selection.

Actions: - Overlay in Navigator — visualise the overlap on the full matrix - ↓ PDF Report — export a formatted comparison report

Mode: Campaigns (DB 1)

Rank named campaigns from the currently ingested ATT&CK release against your current Navigator selection.

The detail panel shows: - Similarity score, shared techniques highlighted in purple - Full campaign technique list with overlap indicators - Attribution (which group conducted this campaign) - Date range of the campaign

Mode: Reports (DB 2)

Browse your stored AI analysis sessions. Click any report body to see which group and campaign profiles have the strongest TTP overlap with its extracted profile — without re-running the expensive LLM call.

Use cases: - Retrospective TTP-overlap review after a new ATT&CK version is released - Cross-incident correlation across multiple saved reports - Environmental profiling — which groups keep appearing across your incident set

Per-session actions: - ↓ PDF — download the full analysis PDF for that session at any time - ↓ STIX/OpenCTI — download a STIX 2.1 bundle containing the report, ATT&CK attack-patterns, and similarity-lead intrusion sets for OpenCTI import - ✕ Remove — delete the session from DB 2 (browser confirm required; list refreshes automatically)

---