ThreatCodex

Transform natural-language cyber threats into validated YARA, Sigma, Snort, and forensic rules using AI agents.

Comment

ThreatCodex

Inspiration

Modern security teams rely on detection rules such as YARA, Sigma, and Snort to identify threats, but creating these rules requires deep cybersecurity expertise and a significant amount of manual effort. Analysts often need to translate lengthy threat reports into multiple detection formats while ensuring that every rule is syntactically correct and operationally useful.

We built ThreatCodex to bridge this gap. Our goal was simple: enable security analysts to describe an attack in plain English and automatically generate validated detection rules, incident response scripts, and forensic artifacts within seconds.

What it does

ThreatCodex transforms natural-language cyber threats into production-ready security artifacts using an agentic AI pipeline.

Given a threat description and optional indicators of compromise (IOCs), the platform:

  • Extracts IPs, domains, hashes, URLs, and other indicators.
  • Maps threats to the MITRE ATT&CK framework.
  • Classifies attacks into categories such as malware, phishing, ransomware, APTs, and web attacks.
  • Generates detection rules in multiple formats, including YARA, Sigma, and Snort.
  • Produces incident response and forensic analysis scripts.
  • Validates every output using native parsers and automatically repairs invalid rules.

The results are streamed to the frontend in real time, allowing analysts to inspect and edit generated artifacts instantly.

How we built it

ThreatCodex is built as a distributed, agent-based system.

Frontend

  • Next.js 14
  • Tailwind CSS
  • shadcn/ui
  • Monaco Editor
  • Server-Sent Events (SSE)

Backend

  • Python 3.12
  • FastAPI
  • Async orchestration with asyncio
  • Celery workers
  • PostgreSQL
  • Redis

AI Pipeline

The backend orchestrates multiple specialized agents:

  1. Threat Enricher extracts indicators and maps attacks to MITRE ATT&CK.
  2. Intent Classifier categorizes threats and determines the required output formats.
  3. Generation Agents independently generate YARA, Sigma, Snort, incident response, and forensic artifacts.
  4. Validation Engine verifies syntax using native tools.
  5. Repair Agent automatically fixes broken outputs when validation fails.

We used:

  • GPT-4o for high-quality rule generation.
  • GPT-4o-mini for classification and IOC extraction.
  • o1-mini for rule repair and debugging.

To improve performance, ThreatCodex uses Redis caching, asynchronous execution, and parallel generation pipelines.

Challenges we ran into

Building ThreatCodex involved several technical challenges:

  • Designing prompts that produce reliable rules across multiple cybersecurity formats.
  • Validating outputs using different parsers such as yara-python, pysigma, and Snort validators.
  • Building an automatic repair loop that could fix invalid rules without introducing new issues.
  • Coordinating multiple AI agents running in parallel while maintaining consistent context.
  • Managing Docker networking and integrating a self-hosted Supabase stack with authentication, storage, and API gateways.
  • Streaming partially completed results to the frontend without blocking the generation pipeline.

One of the hardest problems was balancing generation quality with speed. Generating five different artifacts sequentially led to unacceptable latency, so we redesigned the architecture around asynchronous parallel execution.

What we learned

Through this project, we gained hands-on experience in:

  • Building agentic AI systems.
  • Designing resilient orchestration pipelines.
  • Applying MITRE ATT&CK in practical security workflows.
  • Rule validation and automated repair strategies.
  • Scaling FastAPI applications with Redis and PostgreSQL.
  • Streaming real-time updates using Server-Sent Events.

Most importantly, we learned that AI systems become significantly more useful when generation is combined with validation, feedback loops, and domain-specific tooling.

What's next for ThreatCodex

We plan to extend ThreatCodex with:

  • Support for Suricata, Zeek, and Splunk SPL.
  • Integration with VirusTotal and MISP.
  • Fine-tuned cybersecurity models.
  • Team collaboration and version history.
  • Threat intelligence ingestion from public feeds.
  • One-click deployment to SIEM and SOC platforms.

Our long-term vision is to make ThreatCodex an AI copilot for security teams, helping analysts move from threat intelligence to actionable defenses faster than ever before.

Built With

Share this project:

Updates