Grid Guardian Intel

OSINT threat matrix fusing Censys ICS discovery, MITRE ATT&CK mapping, CISA KEV, and live geo-event feeds into SOC-ready dossiers for US critical infrastructure defense.

Comment

Inspiration The cascade of cyber-physical attacks on US critical infrastructure over the past decade — from Stuxnet to the Colonial Pipeline breach — made one thing painfully clear: defenders are drowning in raw data but starving for actionable intelligence. When an ICS/SCADA device pops up on Shodan or Censys, a SOC analyst gets an IP and a port. That's it. No context. No threat correlation. No idea whether a wildfire 40 miles away just turned that exposure into a five-alarm incident.

We asked ourselves: what if every exposed industrial asset came with its own threat dossier — pre-built, continuously enriched, and ready for an analyst in under 30 seconds? That question became Grid Guardian Intel — a Sentinel-OSINT platform that fuses exposed-asset discovery, structured web intelligence, MITRE ATT&CK mapping, CISA KEV enrichment, and live geo-event feeds into a single, SOC-ready brief per asset. We don't just alert the operator — we turn a raw data point into actionable national security intelligence.

What it does Grid Guardian Intel operates as a four-stage intelligence pipeline:

Ingest — Queries the Censys Platform API v3 for ICS/SCADA services (Modbus, Siemens S7, DNP3, EtherNet/IP, IEC-104, BACnet, and more) scoped to the continental United States, with cursor-based pagination. A mock feed is available when no API key is present, so the platform is immediately demo-able. Analyze — Each asset is enriched through a multi-layered intelligence fusion: SerpApi structured search (primary) composes a strategic brief from dated, cited headlines and organic SERP results; Tavily advanced search serves as AI-native fallback. Every brief carries a P1–P3 priority score, source citations, MITRE ATT&CK technique mapping (with confidence level, rationale, and evidence snippets), and CISA KEV / NVD cross-references. Geo-fuse — A cached GeoEvent store aggregates five real-time feeds: GDACS (global disasters), NASA FIRMS (VIIRS active-fire pixels with severity from Fire Radiative Power), USGS (earthquakes ≥ M4.5, past 7 days), NOAA CAP (active US weather alerts via polygon centroids), and SerpApi/Tavily news sweeps scoped by locale. Each brief shows nearby events with haversine distance and compass bearing — so an Ontario wildfire correctly registers as a cross-border threat to a Michigan grid asset. Visualize & Operate — A Mapbox GL dark-tile map renders assets (blue squares) and geo-events color-coded by severity. The platform supports bulk analysis with configurable exponential backoff and retries, snapshot diffing for watchlist deltas (new/closed assets), Slack/webhook notifications for P1 findings, an ATT&CK tactics heatmap with drill-down, and SOC-ready exports in Markdown, PDF, CSV, JSON, and STIX 2.1 formats. How we built it We built Grid Guardian Intel as a TanStack Start v1 application — React 19 on Vite 7, deployed as a Cloudflare Worker with full SSR. The data layer uses TanStack Query with createServerFn RPC calls and in-worker caches, keeping latency low and state consistent. The UI is built with Tailwind CSS v4 and shadcn primitives, with icons from lucide-react.

The intelligence layer orchestrates multiple APIs: Censys v3 for ICS discovery, SerpApi (google_news + google organic) as the primary live-data provider, and Tavily Search API as the AI-native fallback. Geo-event ingestion hits GDACS, NASA FIRMS, USGS, and NOAA api.weather.gov in parallel, with a 15-minute cache TTL to balance freshness and rate limits. All API keys live server-side only — zero secrets shipped to the browser.

The ATT&CK mapping engine cross-references discovered services and vulnerabilities against the MITRE ATT&CK ICS + Enterprise matrices, producing technique-level mappings with confidence scores and evidence chains. CISA KEV and NVD data is layered on top to flag actively exploited vulnerabilities.

Challenges we ran into Geo-event fusion across borders. Early on, we realized that a simple radius query missed cross-border threats — a disaster in Canada or Mexico can threaten US grid assets. We implemented haversine distance calculations with compass bearings to correctly flag proximate threats regardless of national boundaries, making the system truly North-America-aware. API resilience and fallback chains. Live OSINT APIs have rate limits, downtime, and varying response formats. We built a primary/fallback chain (SerpApi → Tavily) with configurable exponential backoff and retries, plus a mock-feed mode so the entire platform is demo-able even with zero API keys configured. Caching geo-events without going stale. Geo feeds update at different cadences — earthquakes in near-real-time, weather alerts every few minutes, fire data with satellite latency. We tuned cache TTLs per feed (15-minute default) while keeping the architecture flexible enough to let operators force-refresh when operational conditions demand it. Fusing unstructured intel with structured data. Turning a mix of news headlines, SERP snippets, CVE records, and ATT&CK technique descriptions into a coherent brief per asset required careful prompt engineering and source attribution — every claim in a dossier needs a citation, because a SOC analyst can't act on "AI said so." Accomplishments that we're proud of End-to-end SOC-ready pipeline — From a raw Censys ICS hit to a fully attributed, geo-fused, ATT&CK-mapped dossier in one click. No manual correlation. No tab-switching between six different tools. Shareable stateless asset dossiers — The /asset/$ip/$port route generates a fully self-contained brief that can be shared via URL with any stakeholder, no login required. Think of it as "VirusTotal for ICS threat context." Multi-format evidence export — Markdown, PDF, CSV, JSON, and STIX 2.1 output means the intelligence flows into whatever system the analyst already uses, from Jira tickets to SIEM ingest pipelines. Zero-to-demo in under 60 seconds — The mock-feed fallback means anyone can clone the repo, run bun install && bun dev, and see the full pipeline in action immediately — no API keys, no configuration, no excuses. What we learned OSINT is only as good as its attribution. Early drafts of our briefs had AI-generated summaries without clear source links. SOC analysts rejected them outright. We learned that every claim needs a dated, cited source — "SerpApi, 2026-08-15" beats "AI analysis" every time. Geo-context changes everything. An exposed Modbus TCP device in rural Texas is a very different risk profile during a NOAA severe thunderstorm warning versus a clear-sky Tuesday. Layering real-time geo-events onto asset data transformed our threat scores from "theoretical" to "situational." Censys ICS data is a goldmine that most teams underutilize. The depth of service fingerprinting (firmware versions, protocol negotiations, certificate metadata) enables far richer threat modeling than generic port scanning. We're barely scratching the surface. Cloudflare Workers are surprisingly capable for data-heavy apps. Running the entire pipeline — API orchestration, caching, SSR, and static asset serving — on the edge forced us to be disciplined about cold-start times and memory usage, but the latency gains for geo-distributed users were worth it. What's next for Grid Guardian Intel STIX 2.1 bidirectional ingestion — Currently we export STIX; next we'll import threat feeds (STIX/TAXII) so external intel automatically enriches asset dossiers. Watchlist diffing and change detection — Snapshot the exposed-asset landscape daily and alert operators to new ICS exposures appearing on the grid, turning the tool from reactive analysis into proactive monitoring. ATT&CK Navigator integration — Generate downloadable ATT&CK Navigator layer files per asset, so analysts can visually overlay their findings onto the full matrix in the official MITRE tool. Multi-country expansion — The architecture is already geo-aware; extending beyond US country-code scoping to NATO ally grids is primarily a policy and data-sourcing decision, not an engineering one. Operator collaboration — Add shared watchlists and team annotations so SOC teams can collaborate on asset assessments rather than working in silos.

Built With

Share this project:

Updates