Cyllex-Argus is an AI-assisted, fully local threat intelligence pipeline for purple teams that extracts quote-backed claims from web, RSS and document sources and maps them to MITRE ATT&CK with STIX 2.1 and Sigma exports.
| Tool | Cyllex-Framework/Cyllex-Argus — local, AI-powered adversary intelligence pipeline with quote verification and ATT&CK mapping |
| Category | Threat intelligence aggregation and analysis (CTI), LLM-assisted |
| Primary Use | Investigating a named threat actor across web, RSS and supplied documents, consolidating evidence into confidence-scored profiles mapped to MITRE ATT&CK |
| Safe Use | Intended for authorized purple-team work, CTI research and defensive detection engineering; it is an analyst research tool that runs entirely on the operator's own machine |
| Telemetry Note | Explicitly no telemetry and no third-party enrichment unless opted in; LLM calls go only to the configured provider, and every pipeline decision, token cost and timing is recorded in a local audit trace |
Cyllex-Argus positions itself as AI-powered adversary intelligence for purple teams, and the README is unusually precise about what that means in practice. The tool ingests a threat from the web, your RSS feeds and documents you supply, and runs an LLM-driven extraction pipeline that produces claims — each of which must carry a verbatim quote from the source. Those claims are consolidated into confidence-scored assessments mapped to MITRE ATT&CK, rendered as threat profiles in a local web UI, and exportable to Markdown, STIX 2.1 and Sigma rules. The framing throughout is analyst-in-the-loop: a human reviews every step, and the machine is structurally prevented from inventing evidence. That last point is the project's central design thesis, and it is worth examining how it is enforced.
The most interesting architectural decision is that the Validator stage is plain code with no model involved. After the LLM extracts a claim with its citation, a deterministic check drops any claim whose verbatim quote is not actually present in the source document. The README puts it bluntly: a model cannot invent its way past a step that asks for the receipt. In a landscape where LLM summarization tools routinely hallucinate threat-actor attributions, this is a meaningful control — the extraction model proposes, but a string-level verification disposes. Only three stages ever touch a model: triage (a yes/no relevance call per document), analyst (claim extraction with citations, one to twelve calls per chunked document) and the summary writer for executive profiles.
The pipeline runs once per document, writing atomic claims plus the quote behind each one and a per-stage audit row. According to the README, every pipeline decision is traced: what each agent decided, the token cost and the timings. For an operator evaluating LLM tooling for production CTI work, this auditability is arguably as valuable as the quote verification — it turns the black box into something you can review line by line when a profile's conclusions are challenged. The Validator also resolves entities against a local store and the ATT&CK catalogue, and consolidates claims across sources into the assessments the UI renders.
Corroboration logic shows unusual maturity for a small project. The README explains that corroboration counts organisations, not bylines: one publisher row per organisation, resolved by domain, so seven CISA advisories count as one source agreeing with itself rather than seven independent confirmations. This mirrors a classic failure mode in manual OSINT work, where volume of coverage from a single origin gets mistaken for independent confirmation. The documentation set goes further, referencing Admiralty reliability grades and ICD 203 confidence language on its Source Reliability page, which suggests the confidence scores attached to assessments are grounded in established intelligence-community methodology rather than an arbitrary model-generated number.
Every profile opens with the verdict, the README states — who the actor is, what it does, who it targets and how strong the evidence is — written from the consolidated assessments and refreshed on every run. Exports are TLP-aware and, notably, honest about documents the pipeline could not read. That admission of unread sources is a small but telling detail: silent gaps are how intelligence products mislead, and a tool that surfaces its own ingestion failures is easier to trust than one that presents a clean facade over partial coverage.
Installation is deliberately low-friction. The web UI ships pre-built, so only Python 3.12+ is required — no Node, no build step — and it runs on Windows and Linux. It is not on PyPI yet, so it comes from the repository or a release wheel: pip install "git+https://github.com/Cyllex-Framework/Cyllex-Argus.git". Either path puts the argus command on your PATH. Quickstart is four commands: argus init to create ~/.cyllex-argus/, argus attack update to download the MITRE ATT&CK Enterprise bundle, argus investigate "<threat>" --max-docs 10 to run a first investigation, and argus serve for the web UI. If you skip the ATT&CK download, the first launch fetches it automatically and blocks the first investigation until it completes, so you never run against an empty catalogue.
The model layer is refreshingly provider-agnostic. Four backends are supported: claude-code-cli (subscription-controlled, and the only provider with built-in web search), anthropic-api, openai-api and local ollama with a default of qwen2.5:32b-instruct. Per-agent model overrides let you run a cheap model like gpt-4o-mini or claude-haiku-4-5 for the binary triage call and reserve a strong model such as claude-sonnet-5-5 for extraction — a sensible cost split since triage is one call per document while the analyst stage can be a dozen. The extraction schema is enforced server-side via Structured Outputs strict mode for OpenAI and tool-use for Anthropic, so output is always schema-valid even on the less-tuned OpenAI path, which the README candidly admits has had less mileage and may extract fewer claims until prompts are re-tuned.
Configuration lives in ~/.cyllex-argus/argus.toml, with a [llm] block for the base provider and per-agent override tables. API keys can be set via environment variables — which the README notes always win over stored config and never touch disk — or pasted into the settings UI, where they are stored under [llm.anthropic] api_key / [llm.openai] api_key and rendered masked on reload. A base_url override supports OpenAI-compatible proxies like OpenRouter, LocalAI and LiteLLM, and each API-key provider has a Test connection button that calls GET /v1/models to validate credentials. The README even documents a gotcha: Anthropic org-scoped keys return HTTP 400 on /v1/models unless workspace-scoped, saving new users a confusing debugging session.
Privacy posture is stated firmly: everything stays on your machine, no telemetry, no third-party enrichment unless you opt in, and no outbound call per fact. For a tool that ingests potentially sensitive threat reports and internal documents, this matters — the only network egress beyond your configured LLM provider is the web search you explicitly enable (and search is wired exclusively through claude-code-cli as a separate Search provider, which can be set to Disabled for an RSS-and-local-only posture). The docs set includes a dedicated page on exactly what leaves the machine, which is the kind of claim an operator should be able to verify against documentation rather than take on faith.
Operational security of the tool itself deserves a note. The UI listens on http://127.0.0.1:8765 and ships with default credentials of admin / Argus123. The README is explicit: change the password before exposing Argus on a network, via argus set-admin-password or the ARGUS_ADMIN_PASSWORD environment variable, and use argus serve --host 0.0.0.0 only when you intend LAN clients. Because profiles aggregate actor intelligence and your document corpus, the instance itself becomes intelligence worth protecting, and the default credentials should be treated as a first-run liability, not a convenience.
Beyond the core pipeline, the docs reveal a broader CTI platform ambition: TAXII 2.1 and MISP subscriptions for inbound feeds, opt-in IOC enrichment, webhooks, and — more interesting — a read-write TAXII 2.1 server that other tools in your stack can subscribe to. Combined with Sigma rule export referenced against SigmaHQ, Argus is clearly designed to sit mid-pipeline in a detection engineering workflow: adversary research in, consumable detection content out. The watchers feature in the web interface implies continuous monitoring of configured sources rather than one-shot investigations.
Licensing is the main adoption constraint: PolyForm Noncommercial, free for non-commercial use, with no standard OSI license (the repo metadata reports NOASSERTION). At 39 stars and not yet on PyPI, this is an early project, but the README's engineering discipline — deterministic validation, per-stage audit traces, Admiralty-sourced confidence, honest gap reporting — reflects design choices more commonly seen in mature intelligence platforms. For authorized CTI analysts and purple teams who want LLM acceleration without LLM fabrication, the quote-receipt architecture alone makes Cyllex-Argus worth a close read.
In an authorized assessment or defensive research context, Cyllex-Argus is a research and detection tool, not an attack tool: nothing in its pipeline touches a target system, and its outputs — ATT&CK-mapped profiles, STIX 2.1 bundles and Sigma rules — feed threat modeling, detection engineering and reporting. Run it in a lab or analyst workstation against public and supplied sources, change the default admin credentials, and keep the search provider disabled if your engagement's data-handling rules prohibit third-party queries. The educational value here is architectural as much as operational: it demonstrates a defensible pattern for grounding LLM extraction in verifiable source text.
Cyllex-Framework/Cyllex-Argus.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.