็ฎไฝไธญๆ ย |ย ็น้ซไธญๆ ย |ย English
่ฝป้็บง็ฝ็ปๅฎๅ จๅจ่ๅพ่ฐฑๅๆๅผๆ ยท Lightweight Cybersecurity Threat Graph Analysis Engine
ๅพ๏ผThreatGraph-CLI Web ๅฏ่งๅ็้ข โ D3.js ๅๅฏผๅๅพ๏ผๆ่ฒไธป้ข๏ผ
ThreatGraph-CLI ๆฏไธๆฌพ้ขๅๅฎๅ จ็ ็ฉถไบบๅๅ่้ๅๆๅธ็่ฝป้็บงๅฝไปค่กๅจ่ๅพ่ฐฑๅๆๅผๆใๅฎๅฐ็ฆปๆฃ็ๅฎๅ จๆๆ ๏ผIOC๏ผโโIP ๅฐๅใๅๅใURLใ้ฎ็ฎฑใๆไปถๅๅธใๆถๆ่ฝฏไปถๅฎถๆใCVE ๆผๆด็ผๅทโโ่ฝฌๅไธบไธๅผ ๅฏไบคไบใๅฏๆฅ่ฏขใๅฏๅๆ็ๅ ณ็ณปๅพ่ฐฑ๏ผๅธฎๅฉไฝ ๅจ็ป็ซฏไธญๅฟซ้ๅฎๆๅจ่ๅ ณ่ใๆปๅปๆบฏๆบๅๆๅฟๆ็ฅใ
ๅจๆฅๅธธๅฎๅ จ่ฟ่ฅไธญ๏ผๆไปฌ็ปๅธธ้ขไธด่ฟไบๅฐๅข๏ผ
- ๆฐๆฎๅญคๅฒ๏ผๅจ่ๆ ๆฅๆฃ่ฝๅจ CSVใJSONใSTIX ็ญไธๅๆ ผๅผ็ๆไปถไธญ๏ผ้พไปฅ็ปไธๅ ณ่
- ๅทฅๅ ท่่ฟ๏ผไธปๆตๅจ่ๆ ๆฅๅนณๅฐๅจ่พ้่ฆ้จ็ฝฒ Elastic Stack ๆ Neo4j๏ผๅฏน่ฝป้็บงๅบๆฅๅๅบๆฅ่ฏดๅคช้ไบ
- ๅฏ่งๅ้จๆง้ซ๏ผๆณๅฟซ้็ปไธๅผ ๆปๅปๅ ณ็ณปๅพ๏ผๅด่ฆๆๅผ Gephi ๆ Maltego๏ผ้ ็ฝฎ็น็
- ๅๆๆต็จๆญ่ฃ๏ผๅฏผๅ ฅใๅๆใๅฏ่งๅใๅฏผๅบๅพๅพ้่ฆๅๆขๅคไธชๅทฅๅ ท๏ผๆ็ไฝไธ
ThreatGraph-CLI ๆญฃๆฏไธบไบ่งฃๅณ่ฟไบ้ฎ้ข่่ฏ็็ใ
- ้ถไพ่ตๆ ธๅฟ๏ผ็บฏ Python ๅฎ็ฐ๏ผ
pip installๅๅณๅฏไฝฟ็จ๏ผๆ ้ๅฎ่ฃ ๆฐๆฎๅบๆๅพๅผๆ - ๅคๆ ผๅผ้ๅ๏ผCSVใJSONใYAMLใIOC ๆๆฌใSTIX ไธ้ฎๅฏผๅ ฅ๏ผ่ชๅจ่ฏๅซไธๆ ๅฐ
- ๅพ็ฎๆณๅ ็ฝฎ๏ผๆ็ญ่ทฏๅพใไธญๅฟๆงๅๆใ็คพๅบๆฃๆต็ญ็ฎๆณๅผ็ฎฑๅณ็จ
- ไธ้ฎๅฏ่งๅ๏ผๅ
็ฝฎ D3.js ๅๅฏผๅๅพ Web ็้ข๏ผ
threatgraph serveๅณๅฏๅฏๅจ - ็ตๆดปๅฏผๅบ๏ผJSONใCSVใSVGใMermaidใHTML ไบคไบๅผๆฅๅ๏ผ้้ ๅ็งๆฑๆฅๅบๆฏ
| ็นๆง | ThreatGraph-CLI | Neo4j + Bloom | Maltego | Gephi |
|---|---|---|---|---|
| ้ถๅค้จไพ่ต | โ | โ | โ | โ |
| ๅฝไปค่กๅ็ | โ | โ | โ | โ |
| ๅคๆ ผๅผ่ชๅจ่งฃๆ | โ | โ | ||
| ๅ ็ฝฎๅพ็ฎๆณ | โ | โ | โ | |
| Web ๅฏ่งๅ | โ | โ | โ | โ |
| ๅๆไปถ้จ็ฝฒ | โ | โ | โ | โ |
| ๅผๆบๅ ่ดน | โ | โ | โ |
ThreatGraph-CLI ็่ฎพ่ฎก็ตๆๆฅ่ช๏ผ
- MITRE ATT&CK ๆกๆถ็ๆปๅป้พๅปบๆจกๆๆณ
- Graph Theory ๅจ็คพไบค็ฝ็ปๅๆไธญ็ๆ็ๅบ็จ
- Unix ๅฒๅญฆโโๅๅฅฝไธไปถไบ๏ผ้่ฟ็ฎก้็ปๅๅฎๆๅคๆไปปๅก
- ๅฎๅ จ็คพๅบๅฏน"่ฝป้็บงใๅฏ็ฆป็บฟ่ฟ่ก"ๅฎๅ จๅทฅๅ ท็่ฟซๅ้ๆฑ
- ๅค็ฑปๅ่็น๏ผๆฏๆ IPใๅๅใURLใ้ฎ็ฎฑใๆไปถ Hash๏ผMD5/SHA1/SHA256๏ผใๆถๆ่ฝฏไปถๅฎถๆใCVE ็ญ่็น็ฑปๅ
- ไธฐๅฏๅ
ณ็ณป็ฑปๅ๏ผ
resolves_toใcommunicates_withใhosts_malwareใexploitsใassociated_with็ญๅค็งๆๅ่พน - Dijkstra ๆ็ญ่ทฏๅพ๏ผๅฟซ้ๆฅๆพไธคไธช่็น้ด็ๆ็ญๆปๅป่ทฏๅพ
- ไธญๅฟๆงๅๆ๏ผๅบฆไธญๅฟๆง๏ผDegree Centrality๏ผๅไปๆฐไธญๅฟๆง๏ผBetweenness Centrality๏ผ๏ผ็ฒพๅๅฎไฝๅ ณ้ฎ่็น
- ็คพๅบๆฃๆต๏ผๅบไบๆ ็ญพไผ ๆญ็ฎๆณ๏ผLabel Propagation๏ผ่ชๅจๅ็ฐๅจ่่็ฑป
- CSV๏ผ่ชๅจ่ฏๅซๅๅๅนถๆ ๅฐๅฐ่็น/่พน็ฑปๅ๏ผๆฏๆ่ชๅฎไนๅๆ ๅฐ
- JSON๏ผๅ็ JSONใJSON ๅ่กจใๅตๅฅ JSON ไธ็งๆ ผๅผๅ จๅ ผๅฎน
- YAML๏ผ็ปๆๅ้ ็ฝฎๆไปถ็ดๆฅๅฏผๅ ฅ
- IOC ๆๆฌๆๅ๏ผ้่ฟๆญฃๅ่กจ่พพๅผไปไปปๆๆๆฌไธญๆๅ IPใๅๅใURLใHash ็ญ IOC
- STIX ๆ ผๅผ๏ผๆฏๆ STIX 2.x ๆ ผๅผ็ๅจ่ๆ ๆฅๅฏผๅ ฅ
- ๅคๅ ๅญ้ฃ้ฉ่ฏๅ๏ผ็ปผๅ่่่็น็ฑปๅใ่ฟๆฅๆฐใไธญๅฟๆงๆๆ ใ็คพๅบ่งๆจก็ญๅ ็ด ๏ผ่ฎก็ฎ็ปผๅ้ฃ้ฉๅ
- ๅ ณ้ฎ่็น่ฏๅซ๏ผ่ชๅจๅ็ฐๅพ่ฐฑไธญ็ๆข็บฝ่็นๅๆกฅๆข่็น
- ๅ ณ่ๅๆ๏ผๅ็ฐ้่ๅจๆฐๆฎ่ๅ็ๅฎไฝๅ ณ่ๅ ณ็ณป
- ่็ฑปๆฃๆต๏ผๅบไบๅพ็ปๆ่ชๅจ่ฏๅซๅจ่ๅขไผๅๆปๅป็ป็ป
- ๆถ้ด็บฟๅๆ๏ผๆๆถ้ด็ปดๅบฆ่ฟฝ่ธชๅจ่ๆผๅ่ฟ็จ
- ๆปๅป่ทฏๅพๆฅๆพ๏ผไปไปปๆ่ตท็นๅฐ็ป็น็ๆ็ญๆปๅป่ทฏๅพ่ฟๅ
- JSON๏ผ็ปๆๅๆฐๆฎๅฏผๅบ๏ผไพฟไบไธๆธธๅทฅๅ ท้ๆ
- CSV๏ผ่กจๆ ผๅๅฏผๅบ๏ผ้้ Excel ๅ BI ๅทฅๅ ท
- SVG๏ผ็ข้ๅพๅฏผๅบ๏ผ้ๅๆฅๅๅๆผ็คบๆ็จฟ
- Mermaid๏ผMarkdown ๅๅฅฝ็ๆต็จๅพ่ฏญๆณ๏ผๅฏ็ดๆฅๅตๅ ฅๆๆกฃ
- HTML ไบคไบๅผๆฅๅ๏ผๅ ๅต D3.js ็็ฌ็ซ HTML ๆไปถ๏ผๆ ้ๆๅกๅจๅณๅฏๆต่ง
| ๅฝไปค | ๅ่ฝ |
|---|---|
import |
ๅฏผๅ ฅๅจ่ๆฐๆฎ๏ผๆฏๆ CSV/JSON/YAML/IOC/STIX๏ผ |
analyze |
ๆง่กๅพๅๆ๏ผ้ฃ้ฉ่ฏๅ/ไธญๅฟๆง/็คพๅบๆฃๆต/่ทฏๅพๆฅๆพ๏ผ |
export |
ๅฏผๅบๅพ่ฐฑๆฐๆฎ๏ผJSON/CSV/SVG/Mermaid/HTML๏ผ |
template |
ไฝฟ็จ้ข็ฝฎๅๆๆจกๆฟ๏ผ้้ฑผ/ๆถๆ่ฝฏไปถ/APT๏ผ |
stats |
ๆฅ็ๅพ่ฐฑ็ป่ฎกไฟกๆฏ |
serve |
ๅฏๅจ Web ๅฏ่งๅๆๅก |
query |
ไบคไบๅผๅพๆฅ่ฏข |
- Flask REST API๏ผๅฎๆด็ๅ็ซฏๆฅๅฃ๏ผๆฏๆๅพ่ฐฑ CRUD ๅๅๆๆไฝ
- D3.js ๅๅฏผๅๅพ๏ผ็ฉ็ๆจกๆ็่็นๅธๅฑ๏ผ็ด่งๅฑ็คบๅ ณ็ณป็ฝ็ป
- ๆ่ฒไธป้ข๏ผๆค็ผ่ฎพ่ฎก๏ผ้ๅ้ฟๆถ้ดๅๆๅทฅไฝ
- ่็น็่ฒ๏ผๆ่็น็ฑปๅ๏ผIP/ๅๅ/ๆถๆ่ฝฏไปถ็ญ๏ผ่ชๅจ็่ฒ
- ไบคไบๆไฝ๏ผๆฏๆๆๆฝ่็นใ็ผฉๆพ็ปๅธใๆ็ดขๅฎไฝใ็นๅปๆฅ็่ฏฆๆ
- ้้ฑผๆปๅปๅๆ๏ผไธ้ฎๅฏผๅ ฅ้้ฑผ้ฎไปถ็ธๅ ณ IOC๏ผ่ชๅจๆๅปบๆปๅป้พ
- ๆถๆ่ฝฏไปถๆบฏๆบ๏ผไปๆไปถ Hash ๅบๅ๏ผ่ฟฝ่ธชๆถๆ่ฝฏไปถ็ไผ ๆญ่ทฏๅพ
- APT ่ฐๆฅๆจกๆฟ๏ผ้ๅฏน้ซ็บงๆ็ปญๆงๅจ่็ๆ ๅๅๅๆๆต็จ
- ๅพ่ฐฑๆฐๆฎ่ชๅจๆไน
ๅๅฐ
~/.threatgraph/graph.json - ่ทจไผ่ฏไฟ็ๅๆ็ปๆ๏ผๆ ้้ๅคๅฏผๅ ฅ
- Python 3.8 ๆๆด้ซ็ๆฌ
- ๆไฝ็ณป็ป๏ผLinux / macOS / Windows
- ๅฏ้ไพ่ต๏ผ
flaskโ Web ๅฏ่งๅๆจกๅผ๏ผpip install flask๏ผnetworkxโ ๅขๅผบๅพ็ฎๆณ๏ผpip install networkx๏ผpyyamlโ YAML ๆ ผๅผๆฏๆ๏ผpip install pyyaml๏ผ
# ไป GitHub ๅ
้้กน็ฎ
git clone https://github.com/gitstq/ThreatGraph-CLI.git
cd ThreatGraph-CLI
# ๅฎ่ฃ
ๆ ธๅฟ๏ผ้ถๅค้จไพ่ต๏ผ
pip install .
# ๆ่
๏ผๅฎ่ฃ
ๅ
จ้จๅฏ้ไพ่ต
pip install ".[web,enhanced,yaml]"# 1๏ธโฃ ๅฏผๅ
ฅๅจ่ๆฐๆฎ
threatgraph import --format csv --file ioc_data.csv
# 2๏ธโฃ ๆง่กๅๆ
threatgraph analyze --method risk-score
# 3๏ธโฃ ๅฏๅจ Web ๅฏ่งๅ
threatgraph serve --port 8080ๆๅผๆต่งๅจ่ฎฟ้ฎ http://localhost:8080๏ผๅณๅฏ็ๅฐไบคไบๅผๅจ่ๅพ่ฐฑ๏ผ
ๅพ๏ผไธๆญฅๅฟซ้ไธๆ ThreatGraph-CLI
# ่ชๅจ่ฏๅซๅๅๆ ๅฐ
threatgraph import --format csv --file threat_data.csv
# ๆๅฎๅๆ ๅฐ
threatgraph import --format csv --file data.csv \
--map "source_ip=src,dst_ip=target,relation=type"CSV ๆไปถ็คบไพ๏ผ
source_ip,dst_ip,relation,timestamp
192.168.1.100,10.0.0.1,communicates_with,2024-01-15
10.0.0.1,evil.com,resolves_to,2024-01-15
evil.com,phishing-page,hosts_malware,2024-01-16# ๅ็ JSON ๆ ผๅผ
threatgraph import --format json --file nodes.json
# JSON ๅ่กจๆ ผๅผ
threatgraph import --format json --file ioc_list.jsonJSON ๆไปถ็คบไพ๏ผ
{
"nodes": [
{"id": "192.168.1.100", "type": "ip", "labels": ["internal"]},
{"id": "evil.com", "type": "domain", "labels": ["malicious"]}
],
"edges": [
{"source": "192.168.1.100", "target": "evil.com", "relation": "communicates_with"}
]
}# ไปไปปๆๆๆฌไธญๆๅ IOC
threatgraph import --format ioc --file report.txt
# ็ดๆฅไปๆ ๅ่พๅ
ฅๆๅ
cat firewall.log | threatgraph import --format ioc --stdinthreatgraph import --format stix --file threat_intelligence.stix2.jsonthreatgraph import --format yaml --file config.yaml# ๅฏนๆๆ่็น่ฟ่ก้ฃ้ฉ่ฏๅ
threatgraph analyze --method risk-score
# ๆฅ็้ฃ้ฉๆ้ซ็ Top 10 ่็น
threatgraph analyze --method risk-score --top 10
# ๆๅฎ่ฏๅๆ้
threatgraph analyze --method risk-score \
--weights "degree=0.3,betweenness=0.3,community=0.2,type=0.2"# ๅบฆไธญๅฟๆงๅๆ
threatgraph analyze --method degree-centrality
# ไปๆฐไธญๅฟๆงๅๆ
threatgraph analyze --method betweenness-centrality# ๆ ็ญพไผ ๆญ็คพๅบๆฃๆต
threatgraph analyze --method community-detection
# ๆๅฎ่ฟญไปฃๆฌกๆฐ
threatgraph analyze --method community-detection --iterations 100# ๆฅๆพไธคไธช่็น้ด็ๆ็ญ่ทฏๅพ
threatgraph analyze --method shortest-path \
--source "192.168.1.100" --target "evil.com"# ไปๆๅฎ่ตท็นๆฅๆพๆๆๅฏ่พพ็ๆถๆ่็น
threatgraph analyze --method attack-path \
--source "192.168.1.100" --target-type malware# ๅฏผๅบไธบ JSON
threatgraph export --format json --output result.json
# ๅฏผๅบไธบ CSV
threatgraph export --format csv --output result.csv
# ๅฏผๅบไธบ SVG ็ข้ๅพ
threatgraph export --format svg --output graph.svg
# ๅฏผๅบไธบ Mermaid ่ฏญๆณ
threatgraph export --format mermaid --output graph.mmd
# ๅฏผๅบไธบ HTML ไบคไบๅผๆฅๅ
threatgraph export --format html --output report.html# ้้ฑผๆปๅปๅๆๆจกๆฟ
threatgraph template phishing --ioc "suspicious-url.com" --ioc "attacker@evil.com"
# ๆถๆ่ฝฏไปถๆบฏๆบๆจกๆฟ
threatgraph template malware-trace --hash "a1b2c3d4e5f6..."
# APT ่ฐๆฅๆจกๆฟ
threatgraph template apt-investigation --cve "CVE-2024-0001" --domain "c2-server.com"# ๆฅ็ๅบๆฌ็ป่ฎก
threatgraph stats
# ๆฅ็่ฏฆ็ป็ป่ฎก๏ผๅซไธญๅฟๆงๆๆ ๏ผ
threatgraph stats --detailed่พๅบ็คบไพ๏ผ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ ThreatGraph ็ป่ฎกๆฆ่ง โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ ่็นๆปๆฐ: 1,234 โ
โ ่พนๆปๆฐ: 3,456 โ
โ ่็น็ฑปๅ: IP(456) Domain(234) Hash(189) ... โ
โ ๅ
ณ็ณป็ฑปๅ: 12 ็ง โ
โ ็คพๅบๆฐ้: 8 โ
โ ๅญๅจ่ทฏๅพ: ~/.threatgraph/graph.json โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
# ๅฏๅจ Web ๆๅก๏ผ้ป่ฎค็ซฏๅฃ 5000๏ผ
threatgraph serve
# ๆๅฎ็ซฏๅฃๅไธปๆบ
threatgraph serve --host 0.0.0.0 --port 8080
# ๅฏ็จ่ฐ่ฏๆจกๅผ
threatgraph serve --debug
ๅพ๏ผThreatGraph-CLI Web ๅฏ่งๅ็้ข โ ๆ่ฒไธป้ข D3.js ๅๅฏผๅๅพ
# ่ฟๅ
ฅไบคไบๅผๆฅ่ฏขๆจกๅผ
threatgraph query
# ๅจๆฅ่ฏขๆจกๅผไธญ๏ผ
# > find node 192.168.1.100
# > find edges from 192.168.1.100
# > shortest-path 192.168.1.100 evil.com
# > neighbors evil.com --depth 2
# > exitThreatGraph-CLI ้ตๅพชไปฅไธ่ฎพ่ฎกๅๅ๏ผ
- Unix ๅฒๅญฆ๏ผๆฏไธชๅฝไปคๅๅฅฝไธไปถไบ๏ผ้่ฟ็ฎก้ๅ็ปๅๅฎๆๅคๆๅๆ
- ๆธ่ฟๅขๅผบ๏ผๆ ธๅฟๅ่ฝ้ถไพ่ต๏ผๅฏ้ไพ่ตๆ้ๅฎ่ฃ
- ๆฐๆฎ้ฉฑๅจ๏ผๆๆๅๆๅบไบๅพๆฐๆฎ็ปๆ๏ผ็กฎไฟ็ฎๆณ็้็จๆงๅๅฏๆฉๅฑๆง
- ๅฎๅ จๅๆๅธไผๅ ๏ผๅฝไปค่กๅ็๏ผ้้ ๅฎๅ จๅข้็ๆฅๅธธๅทฅไฝๆต
| ๆๆฏ้ๆฉ | ๅๅ |
|---|---|
| ็บฏ Python ๆ ธๅฟ | ๆๅคงๅๅฏ็งปๆคๆง๏ผ้ฟๅ C ๆฉๅฑ็ผ่ฏ้ฎ้ข |
| Flask | ่ฝป้็บง Web ๆกๆถ๏ผไธ้กน็ฎ"่ฝป้"ๅฎไฝไธ่ด |
| D3.js | ๆๆ็็ JavaScript ๅฏ่งๅๅบ๏ผๅๅฏผๅๅพๆๆๅบ่ฒ |
| networkx๏ผๅฏ้๏ผ | Python ็ๆไธญๆๆ็็ๅพ็ฎๆณๅบ |
| JSON ๆไน ๅ | ไบบ็ฑปๅฏ่ฏปใๆไบ่ฐ่ฏใๆ ้ๆฐๆฎๅบไพ่ต |
graph TB
subgraph ่พๅ
ฅๅฑ["๐ฅ ่พๅ
ฅๅฑ"]
CSV["CSV"]
JSON_F["JSON"]
YAML_F["YAML"]
IOC["IOC ๆๆฌ"]
STIX["STIX"]
end
subgraph ๆ ธๅฟๅฑ["๐ง ๆ ธๅฟๅฑ"]
Parser["ๅคๆ ผๅผ่งฃๆๅจ"]
GraphEngine["ๅพๆฐๆฎๅผๆ"]
Algorithms["ๅพ็ฎๆณๅบ"]
Storage["ๆไน
ๅๅญๅจ"]
end
subgraph ๅๆๅฑ["๐ ๅๆๅฑ"]
RiskScore["้ฃ้ฉ่ฏๅ"]
Centrality["ไธญๅฟๆงๅๆ"]
Community["็คพๅบๆฃๆต"]
PathFinder["่ทฏๅพๆฅๆพ"]
Timeline["ๆถ้ด็บฟๅๆ"]
end
subgraph ่พๅบๅฑ["๐ค ่พๅบๅฑ"]
CLI["CLI ๅฝไปค"]
WebVis["Web ๅฏ่งๅ"]
Export["ๅคๆ ผๅผๅฏผๅบ"]
end
CSV --> Parser
JSON_F --> Parser
YAML_F --> Parser
IOC --> Parser
STIX --> Parser
Parser --> GraphEngine
GraphEngine --> Algorithms
GraphEngine --> Storage
GraphEngine --> RiskScore
GraphEngine --> Centrality
GraphEngine --> Community
GraphEngine --> PathFinder
GraphEngine --> Timeline
RiskScore --> CLI
Centrality --> CLI
Community --> CLI
PathFinder --> CLI
Timeline --> CLI
GraphEngine --> WebVis
GraphEngine --> Export
- v1.1๏ผๆฏๆ GraphML ๅ GEXF ๆ ผๅผๅฏผๅ ฅ/ๅฏผๅบ
- v1.2๏ผ้ๆ MITRE ATT&CK ็ฉ้ต่ชๅจๆ ๅฐ
- v1.3๏ผๆทปๅ ๆถ้ดๅบๅๅๆๆจกๅ๏ผๆฏๆๅจ่่ถๅฟ้ขๆต
- v1.5๏ผๆฏๆๆไปถ็ณป็ป๏ผๅ ่ฎธ็จๆท่ชๅฎไนๅๆ็ฎๆณ
- v2.0๏ผๅผๅ ฅๅคๅพ่ฐฑๅ ณ่ๅๆ๏ผๆฏๆ่ทจ่ฐๆฅๅไฝ
git clone https://github.com/gitstq/ThreatGraph-CLI.git
cd ThreatGraph-CLI
pip install .pip install threatgraph-cli# Web ๅฏ่งๅๆฏๆ
pip install threatgraph-cli[web]
# ๅขๅผบ็ฎๆณๆฏๆ
pip install threatgraph-cli[enhanced]
# ๅ
จ้จๅฏ้ไพ่ต
pip install threatgraph-cli[all]# ็ไบง็ฏๅขๅปบ่ฎฎไฝฟ็จ gunicorn
pip install gunicorn
# ๅฏๅจๆๅก
gunicorn -w 4 -b 0.0.0.0:8080 "threatgraph.web:create_app()"
# ๆไฝฟ็จๅ
็ฝฎๅฝไปค
threatgraph serve --host 0.0.0.0 --port 8080# ๆๅปบ้ๅ
docker build -t threatgraph-cli .
# ่ฟ่กๅฎนๅจ
docker run -d -p 8080:8080 -v ~/.threatgraph:/data threatgraph-cliๆไปฌๆฌข่ฟไปปไฝๅฝขๅผ็่ดก็ฎ๏ผๆ ่ฎบๆฏๆไบค Bug ๆฅๅใๆน่ฟๆๆกฃ๏ผ่ฟๆฏ่ดก็ฎๆฐๅ่ฝใ
- Fork ๆฌไปๅบ
- ๅๅปบ็นๆงๅๆฏ๏ผ
git checkout -b feature/your-feature-name - ๆไบคๆดๆน๏ผ
git commit -m "feat: add your feature description" - ๆจ้ๅฐ่ฟ็จ๏ผ
git push origin feature/your-feature-name - ๆไบค Pull Request
่ฏท้ตๅพช Conventional Commits ่ง่๏ผ
feat: ๆฐๅ่ฝ
fix: Bug ไฟฎๅค
docs: ๆๆกฃๆดๆฐ
style: ไปฃ็ ๆ ผๅผ๏ผไธๅฝฑๅ้ป่พ๏ผ
refactor: ้ๆ
test: ๆต่ฏ็ธๅ
ณ
chore: ๆๅปบ/ๅทฅๅ
ท้พ็ธๅ
ณ
- ๆไบค Bug ๅ๏ผ่ฏทๅ ๆ็ดขๅทฒๆ Issue๏ผ้ฟๅ ้ๅค
- Bug ๆฅๅ่ฏทๅ ๅซ๏ผๅค็ฐๆญฅ้ชคใๆๆ่กไธบใๅฎ้ ่กไธบใ็ฏๅขไฟกๆฏ
- ๅ่ฝๅปบ่ฎฎ่ฏทๆ่ฟฐไฝฟ็จๅบๆฏๅ้ขๆๆๆ
ๆฌ้กน็ฎๅบไบ MIT License ๅผๆบใ
MIT License
Copyright (c) 2024 ThreatGraph-CLI Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
โญ ๅฆๆ่ฟไธช้กน็ฎๅฏนไฝ ๆๅธฎๅฉ๏ผๆฌข่ฟ Star ๆฏๆไธไธ๏ผโญ
ThreatGraph-CLI ๆฏไธๆฌพๅฐ็บๅฎๅ จ็ ็ฉถไบบๅก่่้ๅๆๅธซๆ้ ็่ผ้็ดๅฝไปคๅๅจ่ ๅ่ญๅๆๅผๆใๅฎๅฐๆฃ่ฝ็ๅจ่ ๆๆจ๏ผIOC๏ผโโIP ไฝๅใ็ถฒๅๅ็จฑใURLใ้ปๅญ้ต็ฎฑใๆชๆก้ๆนใๆกๆ่ป้ซๅฎถๆใCVE ๆผๆด็ทจ่โโ่ฝๅ็บไธๅผตๅฏไบๅใๅฏๆฅ่ฉขใๅฏๅๆ็้ไฟๅ่ญ๏ผๅๅฉไฝ ๅจ็ต็ซฏๆฉไธญๅฟซ้ๅฎๆๅจ่ ้่ฏใๆปๆๆบฏๆบ่ๆ ๅขๆ็ฅใ
ๅจๆฅๅธธๅฎๅ จ็้ไธญ๏ผๆๅ็ถๅธธ้ข่จไปฅไธๅฐๅข๏ผ
- ่ณๆๅญคๅณถ๏ผๅจ่ ๆ ๅ ฑๆฃ่ฝๅจ CSVใJSONใSTIX ็ญไธๅๆ ผๅผ็ๆชๆกไธญ๏ผ้ฃไปฅ็ตฑไธ้่ฏ
- ๅทฅๅ ท่่ ซ๏ผไธปๆตๅจ่ ๆ ๅ ฑๅนณๅฐๅ่ผ้่ฆ้จ็ฝฒ Elastic Stack ๆ Neo4j๏ผๅฐ่ผ้็ดๆๆฅๅๆไพ่ชชๅคช้ไบ
- ่ฆ่ฆบๅ้ๆชป้ซ๏ผๆณๅฟซ้็ซไธๅผตๆปๆ้ไฟๅ๏ผๅป่ฆๆ้ Gephi ๆ Maltego๏ผ้ ็ฝฎ็น็ฃ
- ๅๆๆต็จๆท่ฃ๏ผๅฏๅ ฅใๅๆใ่ฆ่ฆบๅใๅฏๅบๅพๅพ้่ฆๅๆๅคๅๅทฅๅ ท๏ผๆ็ไฝไธ
ThreatGraph-CLI ๆญฃๆฏ็บไบ่งฃๆฑบ้ไบๅ้ก่่ช็็ใ
- ้ถไพ่ณดๆ ธๅฟ๏ผ็ด Python ๅฏฆไฝ๏ผ
pip installๅพๅณๅฏไฝฟ็จ๏ผ็ก้ ๅฎ่ฃ่ณๆๅบซๆๅๅผๆ - ๅคๆ ผๅผ้ๅ๏ผCSVใJSONใYAMLใIOC ๆๅญใSTIX ไธ้ตๅฏๅ ฅ๏ผ่ชๅ่ญๅฅ่ๆ ๅฐ
- ๅๆผ็ฎๆณๅ งๅปบ๏ผๆ็ญ่ทฏๅพใไธญๅฟๆงๅๆใ็คพ็พคๅตๆธฌ็ญๆผ็ฎๆณ้็ฎฑๅณ็จ
- ไธ้ต่ฆ่ฆบๅ๏ผๅ
งๅปบ D3.js ๅๅฐๅๅ Web ไป้ข๏ผ
threatgraph serveๅณๅฏๅๅ - ้ๆดปๅฏๅบ๏ผJSONใCSVใSVGใMermaidใHTML ไบๅๅผๅ ฑๅ๏ผ้ฉ้ ๅ็จฎๅฝๅ ฑๅ ดๆฏ
| ็นๆง | ThreatGraph-CLI | Neo4j + Bloom | Maltego | Gephi |
|---|---|---|---|---|
| ้ถๅค้จไพ่ณด | โ | โ | โ | โ |
| ๅฝไปคๅๅ็ | โ | โ | โ | โ |
| ๅคๆ ผๅผ่ชๅ่งฃๆ | โ | โ | ||
| ๅ งๅปบๅๆผ็ฎๆณ | โ | โ | โ | |
| Web ่ฆ่ฆบๅ | โ | โ | โ | โ |
| ๅฎๆชๆก้จ็ฝฒ | โ | โ | โ | โ |
| ้ๆบๅ ่ฒป | โ | โ | โ |
ThreatGraph-CLI ็่จญ่จ้ๆไพ่ช๏ผ
- MITRE ATT&CK ๆกๆถ็ๆปๆ้ๅปบๆจกๆๆณ
- Graph Theory ๅจ็คพไบค็ถฒ่ทฏๅๆไธญ็ๆ็ๆ็จ
- Unix ๅฒๅญธโโๅๅฅฝไธไปถไบ๏ผ้้็ฎก้็ตๅๅฎๆ่ค้ไปปๅ
- ๅฎๅ จ็คพ็พคๅฐใ่ผ้็ดใๅฏ้ข็ท้่กใๅฎๅ จๅทฅๅ ท็่ฟซๅ้ๆฑ
- ๅค้กๅ็ฏ้ป๏ผๆฏๆด IPใ็ถฒๅๅ็จฑใURLใ้ปๅญ้ต็ฎฑใๆชๆก Hash๏ผMD5/SHA1/SHA256๏ผใๆกๆ่ป้ซๅฎถๆใCVE ็ญ็ฏ้ป้กๅ
- ่ฑๅฏ้ไฟ้กๅ๏ผ
resolves_toใcommunicates_withใhosts_malwareใexploitsใassociated_with็ญๅค็จฎๆๅ้ - Dijkstra ๆ็ญ่ทฏๅพ๏ผๅฟซ้ๆฅๆพๅ ฉๅ็ฏ้ป้็ๆ็ญๆปๆ่ทฏๅพ
- ไธญๅฟๆงๅๆ๏ผๅบฆไธญๅฟๆง๏ผDegree Centrality๏ผ่ไปๆธไธญๅฟๆง๏ผBetweenness Centrality๏ผ๏ผ็ฒพๆบๅฎไฝ้้ต็ฏ้ป
- ็คพ็พคๅตๆธฌ๏ผๅบๆผๆจ็ฑคๅณๆญๆผ็ฎๆณ๏ผLabel Propagation๏ผ่ชๅ็ผ็พๅจ่ ่้ก
- CSV๏ผ่ชๅ่ญๅฅๆฌไฝๅ็จฑไธฆๆ ๅฐๅฐ็ฏ้ป/้้กๅ๏ผๆฏๆด่ช่จๆฌไฝๆ ๅฐ
- JSON๏ผๅ็ JSONใJSON ๅ่กจใๅทข็ JSON ไธ็จฎๆ ผๅผๅ จ็ธๅฎน
- YAML๏ผ็ตๆงๅ่จญๅฎๆช็ดๆฅๅฏๅ ฅ
- IOC ๆๅญๆๅ๏ผ้้ๆญฃๅ่กจ็คบๅผๅพไปปๆๆๅญไธญๆๅ IPใ็ถฒๅๅ็จฑใURLใHash ็ญ IOC
- STIX ๆ ผๅผ๏ผๆฏๆด STIX 2.x ๆ ผๅผ็ๅจ่ ๆ ๅ ฑๅฏๅ ฅ
- ๅคๅ ๅญ้ขจ้ช่ฉๅ๏ผ็ถๅ่ๆ ฎ็ฏ้ป้กๅใ้ฃๆฅๆธใไธญๅฟๆงๆๆจใ็คพ็พค่ฆๆจก็ญๅ ็ด ๏ผ่จ็ฎ็ถๅ้ขจ้ชๅ
- ้้ต็ฏ้ป่ญๅฅ๏ผ่ชๅ็ผ็พๅ่ญไธญ็ๆจ็ด็ฏ้ป่ๆฉๆจ็ฏ้ป
- ้่ฏๅๆ๏ผ็ผ็พ้ฑ่ๅจ่ณๆ่ๅพ็ๅฏฆ้ซ้่ฏ้ไฟ
- ่้กๅตๆธฌ๏ผๅบๆผๅ็ตๆง่ชๅ่ญๅฅๅจ่ ๅๅคฅ่ๆปๆ็ต็น
- ๆ้็ทๅๆ๏ผๆๆ้็ถญๅบฆ่ฟฝ่นคๅจ่ ๆผๅ้็จ
- ๆปๆ่ทฏๅพๆฅๆพ๏ผๅพไปปๆ่ตท้ปๅฐ็ต้ป็ๆ็ญๆปๆ่ทฏๅพ้ๅ
- JSON๏ผ็ตๆงๅ่ณๆๅฏๅบ๏ผไพฟๆผไธๆธธๅทฅๅ ทๆดๅ
- CSV๏ผ่กจๆ ผๅๅฏๅบ๏ผ้ฉ้ Excel ่ BI ๅทฅๅ ท
- SVG๏ผๅ้ๅๅฏๅบ๏ผ้ฉๅๅ ฑๅ่็ฐกๅ ฑๆ็จฟ
- Mermaid๏ผMarkdown ๅๅ็ๆต็จๅ่ชๆณ๏ผๅฏ็ดๆฅๅตๅ ฅๆไปถ
- HTML ไบๅๅผๅ ฑๅ๏ผๅ งๅต D3.js ็็จ็ซ HTML ๆชๆก๏ผ็ก้ ไผบๆๅจๅณๅฏ็่ฆฝ
| ๅฝไปค | ๅ่ฝ |
|---|---|
import |
ๅฏๅ ฅๅจ่ ่ณๆ๏ผๆฏๆด CSV/JSON/YAML/IOC/STIX๏ผ |
analyze |
ๅท่กๅๅๆ๏ผ้ขจ้ช่ฉๅ/ไธญๅฟๆง/็คพ็พคๅตๆธฌ/่ทฏๅพๆฅๆพ๏ผ |
export |
ๅฏๅบๅ่ญ่ณๆ๏ผJSON/CSV/SVG/Mermaid/HTML๏ผ |
template |
ไฝฟ็จ้ ็ฝฎๅๆๆจกๆฟ๏ผ้ฃ้ญ/ๆกๆ่ป้ซ/APT๏ผ |
stats |
ๆฅ็ๅ่ญ็ตฑ่จ่ณ่จ |
serve |
ๅๅ Web ่ฆ่ฆบๅๆๅ |
query |
ไบๅๅผๅๆฅ่ฉข |
- Flask REST API๏ผๅฎๆด็ๅพ็ซฏไป้ข๏ผๆฏๆดๅ่ญ CRUD ่ๅๆๆไฝ
- D3.js ๅๅฐๅๅ๏ผ็ฉ็ๆจกๆฌ็็ฏ้ปไฝๅฑ๏ผ็ด่งๅฑ็คบ้ไฟ็ถฒ่ทฏ
- ๆ่ฒไธป้ก๏ผ่ญท็ผ่จญ่จ๏ผ้ฉๅ้ทๆ้ๅๆๅทฅไฝ
- ็ฏ้ป่่ฒ๏ผๆ็ฏ้ป้กๅ๏ผIP/็ถฒๅๅ็จฑ/ๆกๆ่ป้ซ็ญ๏ผ่ชๅ่่ฒ
- ไบๅๆไฝ๏ผๆฏๆดๆๆณ็ฏ้ปใ็ธฎๆพ็ซๅธใๆๅฐๅฎไฝใ้ปๆๆฅ็่ฉณๆ
- ้ฃ้ญๆปๆๅๆ๏ผไธ้ตๅฏๅ ฅ้ฃ้ญ้ตไปถ็ธ้ IOC๏ผ่ชๅๅปบๆงๆปๆ้
- ๆกๆ่ป้ซๆบฏๆบ๏ผๅพๆชๆก Hash ๅบ็ผ๏ผ่ฟฝ่นคๆกๆ่ป้ซ็ๅณๆญ่ทฏๅพ
- APT ่ชฟๆฅๆจกๆฟ๏ผ้ๅฐ้ซ้ๆ็บๆงๅจ่ ็ๆจๆบๅๅๆๆต็จ
- ๅ่ญ่ณๆ่ชๅๆไน
ๅ่ณ
~/.threatgraph/graph.json - ่ทจๆ่ฉฑไฟ็ๅๆ็ตๆ๏ผ็ก้ ้่คๅฏๅ ฅ
- Python 3.8 ๆๆด้ซ็ๆฌ
- ไฝๆฅญ็ณป็ตฑ๏ผLinux / macOS / Windows
- ๅฏ้ธไพ่ณด๏ผ
flaskโ Web ่ฆ่ฆบๅๆจกๅผ๏ผpip install flask๏ผnetworkxโ ๅขๅผทๅๆผ็ฎๆณ๏ผpip install networkx๏ผpyyamlโ YAML ๆ ผๅผๆฏๆด๏ผpip install pyyaml๏ผ
# ๅพ GitHub ่ค่ฃฝๅฐๆก
git clone https://github.com/gitstq/ThreatGraph-CLI.git
cd ThreatGraph-CLI
# ๅฎ่ฃๆ ธๅฟ๏ผ้ถๅค้จไพ่ณด๏ผ
pip install .
# ๆ่
๏ผๅฎ่ฃๅ
จ้จๅฏ้ธไพ่ณด
pip install ".[web,enhanced,yaml]"# 1๏ธโฃ ๅฏๅ
ฅๅจ่
่ณๆ
threatgraph import --format csv --file ioc_data.csv
# 2๏ธโฃ ๅท่กๅๆ
threatgraph analyze --method risk-score
# 3๏ธโฃ ๅๅ Web ่ฆ่ฆบๅ
threatgraph serve --port 8080ๆ้็่ฆฝๅจ้ ่จช http://localhost:8080๏ผๅณๅฏ็ๅฐไบๅๅผๅจ่
ๅ่ญ๏ผ
ๅ๏ผไธๆญฅๅฟซ้ไธๆ ThreatGraph-CLI
# ่ชๅ่ญๅฅๆฌไฝๅ็จฑๆ ๅฐ
threatgraph import --format csv --file threat_data.csv
# ๆๅฎๆฌไฝๆ ๅฐ
threatgraph import --format csv --file data.csv \
--map "source_ip=src,dst_ip=target,relation=type"CSV ๆชๆก็ฏไพ๏ผ
source_ip,dst_ip,relation,timestamp
192.168.1.100,10.0.0.1,communicates_with,2024-01-15
10.0.0.1,evil.com,resolves_to,2024-01-15
evil.com,phishing-page,hosts_malware,2024-01-16# ๅ็ JSON ๆ ผๅผ
threatgraph import --format json --file nodes.json
# JSON ๅ่กจๆ ผๅผ
threatgraph import --format json --file ioc_list.jsonJSON ๆชๆก็ฏไพ๏ผ
{
"nodes": [
{"id": "192.168.1.100", "type": "ip", "labels": ["internal"]},
{"id": "evil.com", "type": "domain", "labels": ["malicious"]}
],
"edges": [
{"source": "192.168.1.100", "target": "evil.com", "relation": "communicates_with"}
]
}# ๅพไปปๆๆๅญไธญๆๅ IOC
threatgraph import --format ioc --file report.txt
# ็ดๆฅๅพๆจๆบ่ผธๅ
ฅๆๅ
cat firewall.log | threatgraph import --format ioc --stdinthreatgraph import --format stix --file threat_intelligence.stix2.jsonthreatgraph import --format yaml --file config.yaml# ๅฐๆๆ็ฏ้ป้ฒ่ก้ขจ้ช่ฉๅ
threatgraph analyze --method risk-score
# ๆฅ็้ขจ้ชๆ้ซ็ Top 10 ็ฏ้ป
threatgraph analyze --method risk-score --top 10
# ๆๅฎ่ฉๅๆฌ้
threatgraph analyze --method risk-score \
--weights "degree=0.3,betweenness=0.3,community=0.2,type=0.2"# ๅบฆไธญๅฟๆงๅๆ
threatgraph analyze --method degree-centrality
# ไปๆธไธญๅฟๆงๅๆ
threatgraph analyze --method betweenness-centrality# ๆจ็ฑคๅณๆญ็คพ็พคๅตๆธฌ
threatgraph analyze --method community-detection
# ๆๅฎ่ฟญไปฃๆฌกๆธ
threatgraph analyze --method community-detection --iterations 100# ๆฅๆพๅ
ฉๅ็ฏ้ป้็ๆ็ญ่ทฏๅพ
threatgraph analyze --method shortest-path \
--source "192.168.1.100" --target "evil.com"# ๅพๆๅฎ่ตท้ปๆฅๆพๆๆๅฏ้็ๆกๆ็ฏ้ป
threatgraph analyze --method attack-path \
--source "192.168.1.100" --target-type malware# ๅฏๅบ็บ JSON
threatgraph export --format json --output result.json
# ๅฏๅบ็บ CSV
threatgraph export --format csv --output result.csv
# ๅฏๅบ็บ SVG ๅ้ๅ
threatgraph export --format svg --output graph.svg
# ๅฏๅบ็บ Mermaid ่ชๆณ
threatgraph export --format mermaid --output graph.mmd
# ๅฏๅบ็บ HTML ไบๅๅผๅ ฑๅ
threatgraph export --format html --output report.html# ้ฃ้ญๆปๆๅๆๆจกๆฟ
threatgraph template phishing --ioc "suspicious-url.com" --ioc "attacker@evil.com"
# ๆกๆ่ป้ซๆบฏๆบๆจกๆฟ
threatgraph template malware-trace --hash "a1b2c3d4e5f6..."
# APT ่ชฟๆฅๆจกๆฟ
threatgraph template apt-investigation --cve "CVE-2024-0001" --domain "c2-server.com"# ๆฅ็ๅบๆฌ็ตฑ่จ
threatgraph stats
# ๆฅ็่ฉณ็ดฐ็ตฑ่จ๏ผๅซไธญๅฟๆงๆๆจ๏ผ
threatgraph stats --detailed่ผธๅบ็ฏไพ๏ผ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ ThreatGraph ็ตฑ่จๆฆ่ฆฝ โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ ็ฏ้ป็ธฝๆธ: 1,234 โ
โ ้็ธฝๆธ: 3,456 โ
โ ็ฏ้ป้กๅ: IP(456) Domain(234) Hash(189) ... โ
โ ้ไฟ้กๅ: 12 ็จฎ โ
โ ็คพ็พคๆธ้: 8 โ
โ ๅฒๅญ่ทฏๅพ: ~/.threatgraph/graph.json โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
# ๅๅ Web ๆๅ๏ผ้ ่จญ้ฃๆฅๅ 5000๏ผ
threatgraph serve
# ๆๅฎ้ฃๆฅๅ ่ไธปๆฉ
threatgraph serve --host 0.0.0.0 --port 8080
# ๅ็จ้ค้ฏๆจกๅผ
threatgraph serve --debug
ๅ๏ผThreatGraph-CLI Web ่ฆ่ฆบๅไป้ข โ ๆ่ฒไธป้ก D3.js ๅๅฐๅๅ
# ้ฒๅ
ฅไบๅๅผๆฅ่ฉขๆจกๅผ
threatgraph query
# ๅจๆฅ่ฉขๆจกๅผไธญ๏ผ
# > find node 192.168.1.100
# > find edges from 192.168.1.100
# > shortest-path 192.168.1.100 evil.com
# > neighbors evil.com --depth 2
# > exitThreatGraph-CLI ้ตๅพชไปฅไธ่จญ่จๅๅ๏ผ
- Unix ๅฒๅญธ๏ผๆฏๅๅฝไปคๅๅฅฝไธไปถไบ๏ผ้้็ฎก้่็ตๅๅฎๆ่ค้ๅๆ
- ๆผธ้ฒๅขๅผท๏ผๆ ธๅฟๅ่ฝ้ถไพ่ณด๏ผๅฏ้ธไพ่ณดๆ้ๅฎ่ฃ
- ่ณๆ้ฉ ๅ๏ผๆๆๅๆๅบๆผๅ่ณๆ็ตๆง๏ผ็ขบไฟๆผ็ฎๆณ็้็จๆง่ๅฏๆดๅฑๆง
- ๅฎๅ จๅๆๅธซๅชๅ ๏ผๅฝไปคๅๅ็๏ผ้ฉ้ ๅฎๅ จๅ้็ๆฅๅธธๅทฅไฝๆต
| ๆ่ก้ธๆ | ๅๅ |
|---|---|
| ็ด Python ๆ ธๅฟ | ๆๅคงๅๅฏๆๆง๏ผ้ฟๅ C ๆดๅ ็ทจ่ญฏๅ้ก |
| Flask | ่ผ้็ด Web ๆกๆถ๏ผ่ๅฐๆกใ่ผ้ใๅฎไฝไธ่ด |
| D3.js | ๆๆ็็ JavaScript ่ฆ่ฆบๅๅฝๅผๅบซ๏ผๅๅฐๅๅๆๆๅบ่ฒ |
| networkx๏ผๅฏ้ธ๏ผ | Python ็ๆ ไธญๆๆ็็ๅๆผ็ฎๆณๅฝๅผๅบซ |
| JSON ๆไน ๅ | ไบบ้กๅฏ่ฎใๆๆผ้ค้ฏใ็ก้ ่ณๆๅบซไพ่ณด |
graph TB
subgraph ่ผธๅ
ฅๅฑค["๐ฅ ่ผธๅ
ฅๅฑค"]
CSV["CSV"]
JSON_F["JSON"]
YAML_F["YAML"]
IOC["IOC ๆๅญ"]
STIX["STIX"]
end
subgraph ๆ ธๅฟๅฑค["๐ง ๆ ธๅฟๅฑค"]
Parser["ๅคๆ ผๅผ่งฃๆๅจ"]
GraphEngine["ๅ่ณๆๅผๆ"]
Algorithms["ๅๆผ็ฎๆณๅบซ"]
Storage["ๆไน
ๅๅฒๅญ"]
end
subgraph ๅๆๅฑค["๐ ๅๆๅฑค"]
RiskScore["้ขจ้ช่ฉๅ"]
Centrality["ไธญๅฟๆงๅๆ"]
Community["็คพ็พคๅตๆธฌ"]
PathFinder["่ทฏๅพๆฅๆพ"]
Timeline["ๆ้็ทๅๆ"]
end
subgraph ่ผธๅบๅฑค["๐ค ่ผธๅบๅฑค"]
CLI["CLI ๅฝไปค"]
WebVis["Web ่ฆ่ฆบๅ"]
Export["ๅคๆ ผๅผๅฏๅบ"]
end
CSV --> Parser
JSON_F --> Parser
YAML_F --> Parser
IOC --> Parser
STIX --> Parser
Parser --> GraphEngine
GraphEngine --> Algorithms
GraphEngine --> Storage
GraphEngine --> RiskScore
GraphEngine --> Centrality
GraphEngine --> Community
GraphEngine --> PathFinder
GraphEngine --> Timeline
RiskScore --> CLI
Centrality --> CLI
Community --> CLI
PathFinder --> CLI
Timeline --> CLI
GraphEngine --> WebVis
GraphEngine --> Export
- v1.1๏ผๆฏๆด GraphML ่ GEXF ๆ ผๅผๅฏๅ ฅ/ๅฏๅบ
- v1.2๏ผๆดๅ MITRE ATT&CK ็ฉ้ฃ่ชๅๆ ๅฐ
- v1.3๏ผๆฐๅขๆ้ๅบๅๅๆๆจก็ต๏ผๆฏๆดๅจ่ ่ถจๅข้ ๆธฌ
- v1.5๏ผๆฏๆดๅคๆ็ณป็ตฑ๏ผๅ ่จฑไฝฟ็จ่ ่ช่จๅๆๆผ็ฎๆณ
- v2.0๏ผๅผๅ ฅๅคๅ่ญ้่ฏๅๆ๏ผๆฏๆด่ทจ่ชฟๆฅๅไฝ
git clone https://github.com/gitstq/ThreatGraph-CLI.git
cd ThreatGraph-CLI
pip install .pip install threatgraph-cli# Web ่ฆ่ฆบๅๆฏๆด
pip install threatgraph-cli[web]
# ๅขๅผทๆผ็ฎๆณๆฏๆด
pip install threatgraph-cli[enhanced]
# ๅ
จ้จๅฏ้ธไพ่ณด
pip install threatgraph-cli[all]# ็็ข็ฐๅขๅปบ่ญฐไฝฟ็จ gunicorn
pip install gunicorn
# ๅๅๆๅ
gunicorn -w 4 -b 0.0.0.0:8080 "threatgraph.web:create_app()"
# ๆไฝฟ็จๅ
งๅปบๅฝไปค
threatgraph serve --host 0.0.0.0 --port 8080# ๅปบ็ฝฎๆ ๅ
docker build -t threatgraph-cli .
# ๅท่กๅฎนๅจ
docker run -d -p 8080:8080 -v ~/.threatgraph:/data threatgraph-cliๆๅๆญก่ฟไปปไฝๅฝขๅผ็่ฒข็ป๏ผ็ก่ซๆฏๆไบค Bug ๅๅ ฑใๆน้ฒๆไปถ๏ผ้ๆฏ่ฒข็ปๆฐๅ่ฝใ
- Fork ๆฌๅๅบซ
- ๅปบ็ซ็นๆงๅๆฏ๏ผ
git checkout -b feature/your-feature-name - ๆไบค่ฎๆด๏ผ
git commit -m "feat: add your feature description" - ๆจ้ๅฐ้ ็ซฏ๏ผ
git push origin feature/your-feature-name - ๆไบค Pull Request
่ซ้ตๅพช Conventional Commits ่ฆ็ฏ๏ผ
feat: ๆฐๅ่ฝ
fix: Bug ไฟฎๅพฉ
docs: ๆไปถๆดๆฐ
style: ็จๅผ็ขผๆ ผๅผ๏ผไธๅฝฑ้ฟ้่ผฏ๏ผ
refactor: ้ๆง
test: ๆธฌ่ฉฆ็ธ้
chore: ๅปบ็ฝฎ/ๅทฅๅ
ท้็ธ้
- ๆไบค Bug ๅ๏ผ่ซๅ ๆๅฐๅทฒๆ Issue๏ผ้ฟๅ ้่ค
- Bug ๅๅ ฑ่ซๅ ๅซ๏ผ้็พๆญฅ้ฉใๆๆ่ก็บใๅฏฆ้่ก็บใ็ฐๅข่ณ่จ
- ๅ่ฝๅปบ่ญฐ่ซๆ่ฟฐไฝฟ็จๅ ดๆฏ่้ ๆๆๆ
ๆฌๅฐๆกๅบๆผ MIT License ้ๆบใ
MIT License
Copyright (c) 2024 ThreatGraph-CLI Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
โญ ๅฆๆ้ๅๅฐๆกๅฐไฝ ๆๅนซๅฉ๏ผๆญก่ฟ Star ๆฏๆไธไธ๏ผโญ
ThreatGraph-CLI is a lightweight command-line threat graph analysis engine built for security researchers and blue team analysts. It transforms scattered Indicators of Compromise (IOCs) โ IP addresses, domain names, URLs, email addresses, file hashes, malware families, CVE identifiers โ into an interactive, queryable, and analyzable relationship graph, empowering you to perform threat correlation, attack attribution, and situational awareness right from your terminal.
In day-to-day security operations, we frequently encounter these challenges:
- Data silos: Threat intelligence is scattered across CSV, JSON, STIX, and other formats, making unified correlation difficult
- Bloated toolchains: Mainstream threat intelligence platforms require deploying Elastic Stack or Neo4j โ overkill for lightweight incident response
- High visualization barriers: Quickly sketching an attack relationship graph means firing up Gephi or Maltego with tedious configuration
- Fragmented workflows: Importing, analyzing, visualizing, and exporting often require switching between multiple tools, killing efficiency
ThreatGraph-CLI was born to solve exactly these problems.
- Zero-dependency core: Pure Python implementation โ just
pip installand go, no database or graph engine required - Universal format support: One-click import from CSV, JSON, YAML, IOC text, and STIX with automatic recognition and mapping
- Built-in graph algorithms: Shortest path, centrality analysis, community detection โ all ready out of the box
- One-command visualization: Built-in D3.js force-directed graph web UI โ just run
threatgraph serve - Flexible export: JSON, CSV, SVG, Mermaid, and interactive HTML reports to fit any reporting scenario
| Feature | ThreatGraph-CLI | Neo4j + Bloom | Maltego | Gephi |
|---|---|---|---|---|
| Zero external dependencies | โ | โ | โ | โ |
| CLI-native | โ | โ | โ | โ |
| Multi-format auto-parsing | โ | โ | ||
| Built-in graph algorithms | โ | โ | โ | |
| Web visualization | โ | โ | โ | โ |
| Single-file deployment | โ | โ | โ | โ |
| Free & open source | โ | โ | โ |
ThreatGraph-CLI draws design inspiration from:
- MITRE ATT&CK framework's attack chain modeling philosophy
- Graph Theory applications in social network analysis
- The Unix philosophy โ do one thing well, compose complex tasks through pipelines
- The security community's urgent need for lightweight, offline-capable security tools
- Multi-type nodes: Supports IP, domain, URL, email, file hash (MD5/SHA1/SHA256), malware family, CVE, and more
- Rich relationship types:
resolves_to,communicates_with,hosts_malware,exploits,associated_with, and other directed edge types - Dijkstra shortest path: Quickly find the shortest attack path between any two nodes
- Centrality analysis: Degree Centrality and Betweenness Centrality for pinpointing critical nodes
- Community detection: Automatic threat cluster discovery via Label Propagation algorithm
- CSV: Auto-detects column names and maps them to node/edge types, with custom column mapping support
- JSON: Full compatibility with native JSON, JSON lists, and nested JSON formats
- YAML: Direct import of structured configuration files
- IOC text extraction: Regex-powered extraction of IPs, domains, URLs, and hashes from arbitrary text
- STIX format: Import from STIX 2.x threat intelligence feeds
- Multi-factor risk scoring: Computes composite risk scores considering node type, connection count, centrality metrics, and community size
- Key node identification: Automatically discovers hub nodes and bridge nodes in the graph
- Correlation analysis: Uncovers hidden entity relationships buried in your data
- Cluster detection: Identifies threat groups and attack organizations based on graph topology
- Timeline analysis: Tracks threat evolution along the time dimension
- Attack path finding: Reconstructs the shortest attack path from any origin to destination
- JSON: Structured data export for downstream tool integration
- CSV: Tabular export compatible with Excel and BI tools
- SVG: Vector graphics export for reports and presentations
- Mermaid: Markdown-friendly diagram syntax โ embed directly in docs
- HTML interactive report: Self-contained HTML with embedded D3.js โ no server needed to view
| Command | Function |
|---|---|
import |
Import threat data (CSV/JSON/YAML/IOC/STIX) |
analyze |
Run graph analysis (risk scoring/centrality/community detection/path finding) |
export |
Export graph data (JSON/CSV/SVG/Mermaid/HTML) |
template |
Use pre-built analysis templates (phishing/malware/APT) |
stats |
View graph statistics |
serve |
Launch web visualization service |
query |
Interactive graph querying |
- Flask REST API: Complete backend interface supporting graph CRUD and analysis operations
- D3.js force-directed graph: Physics-simulated node layout for intuitive network visualization
- Dark theme: Easy on the eyes during extended analysis sessions
- Node coloring: Automatic color-coding by node type (IP/domain/malware/etc.)
- Interactive controls: Drag nodes, zoom canvas, search and locate, click for details
- Phishing analysis: One-click import of phishing-related IOCs with automatic attack chain construction
- Malware tracing: Trace malware propagation paths starting from a file hash
- APT investigation template: Standardized analysis workflow for advanced persistent threats
- Graph data is automatically persisted to
~/.threatgraph/graph.json - Analysis results carry over across sessions โ no need to re-import
- Python 3.8 or later
- Operating System: Linux / macOS / Windows
- Optional dependencies:
flaskโ Web visualization mode (pip install flask)networkxโ Enhanced graph algorithms (pip install networkx)pyyamlโ YAML format support (pip install pyyaml)
# Clone from GitHub
git clone https://github.com/gitstq/ThreatGraph-CLI.git
cd ThreatGraph-CLI
# Install core (zero external dependencies)
pip install .
# Or install all optional dependencies
pip install ".[web,enhanced,yaml]"# 1๏ธโฃ Import threat data
threatgraph import --format csv --file ioc_data.csv
# 2๏ธโฃ Run analysis
threatgraph analyze --method risk-score
# 3๏ธโฃ Launch web visualization
threatgraph serve --port 8080Open your browser and navigate to http://localhost:8080 to see the interactive threat graph!
Fig: Three steps to get started with ThreatGraph-CLI
# Auto-detect column name mapping
threatgraph import --format csv --file threat_data.csv
# Specify custom column mapping
threatgraph import --format csv --file data.csv \
--map "source_ip=src,dst_ip=target,relation=type"Example CSV file:
source_ip,dst_ip,relation,timestamp
192.168.1.100,10.0.0.1,communicates_with,2024-01-15
10.0.0.1,evil.com,resolves_to,2024-01-15
evil.com,phishing-page,hosts_malware,2024-01-16# Native JSON format
threatgraph import --format json --file nodes.json
# JSON list format
threatgraph import --format json --file ioc_list.jsonExample JSON file:
{
"nodes": [
{"id": "192.168.1.100", "type": "ip", "labels": ["internal"]},
{"id": "evil.com", "type": "domain", "labels": ["malicious"]}
],
"edges": [
{"source": "192.168.1.100", "target": "evil.com", "relation": "communicates_with"}
]
}# Extract IOCs from arbitrary text
threatgraph import --format ioc --file report.txt
# Extract directly from stdin
cat firewall.log | threatgraph import --format ioc --stdinthreatgraph import --format stix --file threat_intelligence.stix2.jsonthreatgraph import --format yaml --file config.yaml# Score all nodes for risk
threatgraph analyze --method risk-score
# View top 10 highest-risk nodes
threatgraph analyze --method risk-score --top 10
# Specify custom scoring weights
threatgraph analyze --method risk-score \
--weights "degree=0.3,betweenness=0.3,community=0.2,type=0.2"# Degree centrality analysis
threatgraph analyze --method degree-centrality
# Betweenness centrality analysis
threatgraph analyze --method betweenness-centrality# Label propagation community detection
threatgraph analyze --method community-detection
# Specify iteration count
threatgraph analyze --method community-detection --iterations 100# Find the shortest path between two nodes
threatgraph analyze --method shortest-path \
--source "192.168.1.100" --target "evil.com"# Find all reachable malicious nodes from a given source
threatgraph analyze --method attack-path \
--source "192.168.1.100" --target-type malware# Export as JSON
threatgraph export --format json --output result.json
# Export as CSV
threatgraph export --format csv --output result.csv
# Export as SVG vector graphic
threatgraph export --format svg --output graph.svg
# Export as Mermaid syntax
threatgraph export --format mermaid --output graph.mmd
# Export as interactive HTML report
threatgraph export --format html --output report.html# Phishing analysis template
threatgraph template phishing --ioc "suspicious-url.com" --ioc "attacker@evil.com"
# Malware tracing template
threatgraph template malware-trace --hash "a1b2c3d4e5f6..."
# APT investigation template
threatgraph template apt-investigation --cve "CVE-2024-0001" --domain "c2-server.com"# View basic statistics
threatgraph stats
# View detailed statistics (including centrality metrics)
threatgraph stats --detailedExample output:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ ThreatGraph Statistics Overview โ
โ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฃ
โ Total Nodes: 1,234 โ
โ Total Edges: 3,456 โ
โ Node Types: IP(456) Domain(234) Hash(189) โ
โ Relation Types: 12 โ
โ Communities: 8 โ
โ Storage Path: ~/.threatgraph/graph.json โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
# Launch web service (default port 5000)
threatgraph serve
# Specify port and host
threatgraph serve --host 0.0.0.0 --port 8080
# Enable debug mode
threatgraph serve --debug
Fig: ThreatGraph-CLI Web Visualization โ Dark-themed D3.js force-directed graph
# Enter interactive query mode
threatgraph query
# Inside query mode:
# > find node 192.168.1.100
# > find edges from 192.168.1.100
# > shortest-path 192.168.1.100 evil.com
# > neighbors evil.com --depth 2
# > exitThreatGraph-CLI follows these core design principles:
- Unix philosophy: Each command does one thing well; compose complex analyses through pipelines
- Progressive enhancement: Zero dependencies for core features; optional dependencies installed on demand
- Data-driven: All analyses built on graph data structures, ensuring algorithmic generality and extensibility
- Analyst-first: CLI-native design tailored to security teams' daily workflows
| Choice | Rationale |
|---|---|
| Pure Python core | Maximizes portability; avoids C extension compilation issues |
| Flask | Lightweight web framework aligned with the project's "lightweight" positioning |
| D3.js | The most mature JavaScript visualization library with excellent force-directed graph support |
| networkx (optional) | The most mature graph algorithm library in the Python ecosystem |
| JSON persistence | Human-readable, easy to debug, no database dependency |
graph TB
subgraph Input["๐ฅ Input Layer"]
CSV["CSV"]
JSON_F["JSON"]
YAML_F["YAML"]
IOC["IOC Text"]
STIX["STIX"]
end
subgraph Core["๐ง Core Layer"]
Parser["Multi-format Parser"]
GraphEngine["Graph Data Engine"]
Algorithms["Algorithm Library"]
Storage["Persistent Storage"]
end
subgraph Analysis["๐ Analysis Layer"]
RiskScore["Risk Scoring"]
Centrality["Centrality Analysis"]
Community["Community Detection"]
PathFinder["Path Finding"]
Timeline["Timeline Analysis"]
end
subgraph Output["๐ค Output Layer"]
CLI["CLI Commands"]
WebVis["Web Visualization"]
Export["Multi-format Export"]
end
CSV --> Parser
JSON_F --> Parser
YAML_F --> Parser
IOC --> Parser
STIX --> Parser
Parser --> GraphEngine
GraphEngine --> Algorithms
GraphEngine --> Storage
GraphEngine --> RiskScore
GraphEngine --> Centrality
GraphEngine --> Community
GraphEngine --> PathFinder
GraphEngine --> Timeline
RiskScore --> CLI
Centrality --> CLI
Community --> CLI
PathFinder --> CLI
Timeline --> CLI
GraphEngine --> WebVis
GraphEngine --> Export
- v1.1: GraphML and GEXF format import/export support
- v1.2: MITRE ATT&CK matrix auto-mapping integration
- v1.3: Time series analysis module for threat trend prediction
- v1.5: Plugin system for user-defined analysis algorithms
- v2.0: Multi-graph correlation analysis with cross-investigation collaboration
git clone https://github.com/gitstq/ThreatGraph-CLI.git
cd ThreatGraph-CLI
pip install .pip install threatgraph-cli# Web visualization support
pip install threatgraph-cli[web]
# Enhanced algorithm support
pip install threatgraph-cli[enhanced]
# All optional dependencies
pip install threatgraph-cli[all]# For production, we recommend using gunicorn
pip install gunicorn
# Launch the service
gunicorn -w 4 -b 0.0.0.0:8080 "threatgraph.web:create_app()"
# Or use the built-in command
threatgraph serve --host 0.0.0.0 --port 8080# Build the image
docker build -t threatgraph-cli .
# Run the container
docker run -d -p 8080:8080 -v ~/.threatgraph:/data threatgraph-cliWe welcome contributions of all kinds โ whether it's filing a bug report, improving documentation, or contributing new features.
- Fork this repository
- Create a feature branch:
git checkout -b feature/your-feature-name - Commit your changes:
git commit -m "feat: add your feature description" - Push to remote:
git push origin feature/your-feature-name - Submit a Pull Request
Please follow the Conventional Commits specification:
feat: New feature
fix: Bug fix
docs: Documentation update
style: Code formatting (no logic change)
refactor: Code refactoring
test: Test-related changes
chore: Build/tooling changes
- Search existing issues before submitting a new bug report to avoid duplicates
- Bug reports must include: reproduction steps, expected behavior, actual behavior, and environment details
- Feature requests should describe the use case and expected outcome
This project is licensed under the MIT License.
MIT License
Copyright (c) 2024 ThreatGraph-CLI Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
โญ If you find this project helpful, please give it a Star! โญ
Made with โค๏ธ by ThreatGraph-CLI Contributors