Skip to content

Heimdall v1.0.0 — IC-Grade Intelligence Platform

Choose a tag to compare

View all tags
@ankurCES ankurCES released this 26 Apr 22:57
· 44 commits to main since this release
v1.0.0
cd8c32f

First major release. Heimdall now produces analytic products that conform to authentic Intelligence Community formatting, sourcing, and tradecraft standards (ICD 203), with cross-referenced threat indicators and analyst-grade structured analytic techniques.

What's new

📋 Multi-format reports (NIE / PDB / IIR / Full Assessment)

Pick the output format from a dropdown in the chat toolbar — or let it auto-select based on your query. Each format mirrors the structure of authentic declassified products (ODNI ICAs, NIEs, DIA IIRs, Nixon/Ford-era PDBs).

🎯 ICD 203 compliance scoring + auto-regeneration

Every report is scored against 8 of the 9 IC analytic tradecraft standards. Reports below 70/100 trigger a one-shot LLM regeneration with deficiency notes. The full Words of Estimative Probability scale (almost no chance → almost certainly) is now mandatory in analyst output.

🛡️ Threat-feed cross-reference

  • MITRE ATT&CK: 1,647 indicators (172 actors / 693 malware families / 91 tools / 691 TTPs) auto-ingested on first boot, weekly refresh
  • MISP public feeds: CIRCL OSINT, botvrij, ThreatFox available with daily refresh
  • Every IOC mentioned in your reports gets cross-referenced — known-bad indicators are annotated with severity icons (🔴/🟠/🟡)
  • Dark-web report severity now auto-bumps when content matches threat-feed indicators

📚 CIA CREST training corpus + few-shot exemplars

  • Pull declassified IC documents from Internet Archive's 851,358-doc CIA mirror by topic
  • Pre-OCR'd full text — no PDF parsing required locally
  • ExemplarSelector picks topic-matched real declassified docs and injects them into the analyst prompt as format references
  • Era-bucketed: cold_war / post_cold_war / gwot / modern

🧩 Structured Analytic Techniques (4 SATs)

Toggleable from the chat toolbar:

  • ACH — Analysis of Competing Hypotheses (Heuer matrix with C/I/NA scoring, leading hypothesis identification)
  • KAC — Key Assumptions Check (fragility rating + verifiability)
  • RedT — Red Team (Devil's Advocacy + Red Hat adversary perspective)
  • I&W — Indicators & Warnings framework (confirming/refuting indicators per key judgment)

Each appends a typed annex to the report; results visible directly in the chat output.

⚙️ Settings → Training Data tab

  • Total indicators / per-source breakdowns / last-sync times
  • Manual MITRE/MISP/CREST sync controls
  • Live IOC scanner (paste text → see threat-feed matches)
  • Tradecraft Compliance History (avg score, pass rate, regen count, scrollable list of recent reports)

🧱 8 new workflow nodes

Drop into custom workflows in the visual editor:
FormatSelector · ACHMatrix · KeyAssumptions · RedTeam · Indicators · ThreatFeedCheck · TradecraftScore · ExemplarInject

🗄️ Database

Migration 041 adds three new tables:

  • training_corpus — declassified docs for few-shot exemplars
  • threat_feeds — MITRE/MISP indicators with stix_id and misp_event_id linking
  • report_quality_scores — ICD 203 history per report

Verification

16 unit tests (vitest) covering ThreatFeedMatcher and MispFeedIngester. Run:

npm test

Downloads

  • macOS Apple Silicon (arm64): Heimdall-1.0.0-arm64.dmg
  • macOS Intel (x64): Heimdall-1.0.0.dmg

Both unsigned — when first opening, right-click → Open to bypass Gatekeeper, or xattr -dr com.apple.quarantine /Applications/Heimdall.app.

Assets 4
Loading