Threat Intelligence Center

Threat Intelligence Center

The Threat Intelligence Center (Apps → Threat Intelligence, shipped in 0.1.9e Build 15) keeps a local store of vulnerability intelligence on the machine, matches it against what you actually run and work on, and puts it in Navi's hands in chat. The engine is intel.py, a standard-library module beside the bridge; the store is config/intel.db.

Sources (keyless only)

• NVD API 2.0 — keyless tier, incremental last-modified windows, politely paced. Owns a record's title, description, CVSS, products (CPEs), references, and dates.
• CISA KEV — the known-exploited-vulnerabilities catalog JSON. Owns exploited status, date added, due date, and ransomware use.
• EPSS — exploit-prediction scores from FIRST, batched over the store; keeps score history so movers can be ranked.
• CISA advisories RSS and curated RSS (Krebs on Security, BleepingComputer) — advisories ride along with the digest.

No API key or account is needed — or supported — in v1. A record's identity is its CVE ID; sources merge field-by-field, fetches are conditional (ETag / Last-Modified), and every source carries a freshness stamp: fresh under 12h, aging under 48h, stale beyond. Last-good data is served with its age labeled — never a silent old picture.

Matching — local, declared, labeled

Terms come from three declared places: your watchlist, the Mesh roster (this node's platform family and paired peers' names), and words from your cases (manifests and finding titles). A term equal to a CPE product grades exact; a bounded text hit in a title or description grades keyword. Matching happens on the machine — the watchlist and inventory are never sent to a feed. v1 does not read installed packages.

Navi's awareness

• A standing brief — collector, KEV totals, match counts, top records, per-source freshness — rides Navi's chat context within a ~700-token budget whenever the Center is enabled and the store is nonempty.
• Deterministic lookup: intel: <query>, "what do we know about CVE-…", or "look up CVE-…" answers straight from the store, no model round-trip — and says honestly when the store is empty or the record absent.
• Seams: naming a CVE or a watched term in ordinary chat pulls that record into that reply; in a case-bound chat, the case's matched records ride too.
• From any record, File into the open case files it as a finding (severity mapped from CVSS) with its citation — CVE ID plus digest stamp — written into the note, so case exports carry it.

The Mesh carries the weight

One node collects; the digest (navi-intel-digest/1 — collector identity, per-source stamps, ranked sections, up to 300 records, the brief text) travels the peer-authenticated Mesh door (GET /mesh/intel-digest) to thin clients, which import it and match locally. Set intel.collectorPeer to pin a collector. If the collector is unreachable, the failure is recorded on the Mesh source line, and a receiver collects locally only if the fallback setting is on — never silently. There is no automatic collector election in v1.

Deferred beyond v1

OSV.dev on-demand lookups, vendor PSIRT feeds beyond the curated pair, NVD API-key support, installed-package inventory reading, automatic collector election, and any mobile whisper for intel.