🛡️ ThreatView — Threat Intelligence Dashboard

An affordable, aggregated threat intelligence dashboard that translates raw data into actionable insights for SMBs.

ThreatView acts as a central nervous system for threat data — ingesting noisy data from sources like AlienVault OTX, PhishTank, and AbuseIPDB, normalizing it, and presenting it so a non-expert IT manager can say: "We need to block this IP address immediately."

---

🏗️ Architecture

┌──────────────────────────────────────────────────────────┐
│                    REACT FRONTEND                         │
│  Dashboard │ IoC Search │ Alerts │ Reports │ Settings     │
│  Recharts  │ TailwindCSS │ Lucide Icons                  │
└────────────────────────┬─────────────────────────────────┘
                         │ REST API
┌────────────────────────▼─────────────────────────────────┐
│                  FASTAPI BACKEND                           │
│  Auth (JWT) │ Dashboard │ IoC Search │ Alerts │ Reports   │
├──────────────────────────────────────────────────────────┤
│              INGESTION ENGINE (ETL)                        │
│  AlienVault OTX │ PhishTank │ AbuseIPDB                   │
│  BaseIngestor (normalize → upsert → dedup)               │
├──────────────────────────────────────────────────────────┤
│              SCHEDULER (APScheduler)                       │
│  Data ingestion: every 30 min │ Alerts: every 5 min       │
├──────────────────────────────────────────────────────────┤
│              DATABASE (SQLite/PostgreSQL)                   │
│  Users │ IoCs │ Alerts │ Alert Rules │ Ingestion Logs      │
└──────────────────────────────────────────────────────────┘

📁 Project Structure

threatview/
├── backend/
│   ├── main.py                     # FastAPI entry point
│   ├── requirements.txt            # Python dependencies
│   ├── .env.example                # Environment variables template
│   └── app/
│       ├── config.py               # Settings & env vars
│       ├── database.py             # Async SQLAlchemy setup
│       ├── models/
│       │   ├── models.py           # ORM models (User, IoC, Alert, etc.)
│       │   └── schemas.py          # Pydantic request/response schemas
│       ├── ingestors/
│       │   ├── base.py             # BaseIngestor (abstract ETL)
│       │   ├── alienvault.py       # AlienVault OTX connector
│       │   ├── phishguard.py       # PhishTank phishing URLs
│       │   └── abuseipdb.py        # AbuseIPDB IP reputation
│       ├── api/
│       │   ├── auth.py             # Register, login, profile
│       │   ├── dashboard.py        # Stats, trends, charts
│       │   ├── iocs.py             # IoC search, filter, export
│       │   ├── alerts.py           # Alert rules, brand monitoring
│       │   └── reports.py          # PDF report generation
│       ├── services/
│       │   ├── scheduler.py        # APScheduler job runner
│       │   ├── alerting.py         # Alert rule engine
│       │   └── reports.py          # ReportLab PDF generator
│       └── utils/
│           └── auth.py             # JWT auth, password hashing, RBAC
└── frontend/
    ├── package.json
    ├── vite.config.js              # Vite with API proxy
    ├── tailwind.config.js
    ├── index.html
    └── src/
        ├── main.jsx
        ├── index.css
        ├── App.jsx                 # Router + protected routes
        ├── context/
        │   └── AuthContext.jsx     # Auth state management
        ├── utils/
        │   └── api.js              # API client with JWT
        ├── components/
        │   └── Layout.jsx          # Sidebar navigation
        └── pages/
            ├── LoginPage.jsx
            ├── RegisterPage.jsx
            ├── DashboardPage.jsx    # Charts, stats, trends
            ├── IoCsPage.jsx         # Search & filter IoCs
            ├── AlertsPage.jsx       # Alert rules + brand monitoring
            ├── ReportsPage.jsx      # PDF report preview + download
            └── SettingsPage.jsx     # Profile + API access

🚀 Quick Start

Prerequisites

• Python 3.10+
• Node.js 18+
• npm or yarn

Backend

cd backend
pip install -r requirements.txt

# Copy and edit environment variables
cp .env.example .env

# Start the server (creates DB + seeds demo data automatically)
python -m uvicorn main:app --reload --port 8000

The backend will:

1. Create the SQLite database
2. Seed demo users (demo/demo123, freeuser/free123)
3. Run initial ingestion with mock threat data
4. Start the scheduler (ingestion every 30min, alerts every 5min)

Frontend

cd frontend
npm install
npm run dev

Open http://localhost:5173

Demo Credentials

Account	Username	Password	Tier
Pro	demo	demo123	⚡ PRO
Free	freeuser	free123	FREE

🎯 Key Features

Phase 1: Ingestion Engine (ETL)

• AlienVault OTX: Malicious IPs, domains, URLs, file hashes from threat pulses
• PhishTank: Verified phishing URLs targeting banks, tech companies, government
• AbuseIPDB: IP reputation with abuse confidence scores
• Normalization: All sources mapped to a unified IoC model (value, type, threat, severity, country, confidence)
• Scheduler: APScheduler runs ingestion every 30 minutes with full ETL cycle

Phase 2: Intelligence Dashboard

• Stats Cards: Total IoCs, 24h count, 7-day count, active alerts
• Threat Type Distribution: Donut chart showing malware, phishing, ransomware, etc.
• Severity Distribution: Bar chart with color-coded severity levels
• Top Source Countries: Ranked list with country flags and progress bars
• Threat Trends: 8-day area chart showing trend lines per threat type
• Data Sources: Status cards for each intelligence feed

Phase 3: Alerting & Search

• IoC Search: Full-text search across IoC values, descriptions, and tags
• Filters: IoC type, threat type, severity range
• Alert Rules: Custom rules with industry match, threat type, severity threshold, keyword
• Brand Monitoring: Add domains to watchlist; auto-alerts if found in phishing feeds
• Alert Types: IoC Match, Brand Alert, Industry Alert, Threat Spike

Phase 4: Reporting & Monetization

• PDF Generation: Weekly Threat Landscape report with ReportLab
  • Executive summary
  • Threat type breakdown table
  • Top source countries
  • Top 20 highest-severity indicators
  • Data source summary
• CSV Export: Pro-only IoC export with full fields
• Tiered Access (RBAC):
  • Free: 24-hour data window, basic search, 3 alert rules
  • Pro: Historical search, API access, CSV export, PDF reports, unlimited rules

🔌 API Documentation

Once the backend is running, visit:

• Swagger UI: http://localhost:8000/docs
• ReDoc: http://localhost:8000/redoc

Key Endpoints

Method	Endpoint	Auth	Tier	Description
POST	/api/auth/register	No	—	Create account
POST	/api/auth/login	No	—	Get JWT token
GET	/api/auth/me	Yes	—	Get profile
GET	/api/dashboard/stats	Yes	—	Dashboard stats
GET	/api/iocs/search?q=	Yes	Free/Pro*	Search IoCs
GET	/api/iocs/latest	Yes	—	Latest IoCs
GET	/api/iocs/export/csv	Yes	Pro	CSV export
GET	/api/alerts/	Yes	—	List alerts
POST	/api/alerts/rules	Yes	—	Create alert rule
POST	/api/alerts/brand-monitor	Yes	—	Add domain monitor
GET	/api/reports/weekly	Yes	Pro	Download PDF
GET	/api/reports/preview	Yes	Free	Report preview

* Free tier limited to 24h data window

🌐 Integrated Threat Feeds

Source	API	Data Type	Auth
AlienVault OTX	otx.alienvault.com	IPs, domains, hashes, pulses	API Key (optional)
PhishTank	data.phishtank.com	Verified phishing URLs	API Key (optional)
AbuseIPDB	abuseipdb.com	IP reputation + geolocation	API Key (optional)

Demo Mode: When API keys are not configured, all ingestors return realistic mock data so the dashboard works out of the box.

🛠️ Tech Stack

Layer	Technology
Frontend	React 18, Vite, TailwindCSS, Recharts, Lucide Icons
Backend	Python, FastAPI, SQLAlchemy (async), Pydantic v2
Database	SQLite (dev) / PostgreSQL (prod)
Auth	JWT (python-jose), bcrypt
Scheduling	APScheduler
PDF Reports	ReportLab
Deployment	Cloud-ready (Docker, AWS, GCP, Azure)

📊 Data Flow

External APIs → Ingestors → Normalize → Upsert/Dedup → Database
                                                          ↓
Scheduler (30min)                              Dashboard API → React Charts
                                                          ↓
Alert Engine (5min)                          Alert Rules → User Notifications

🔒 Security Notes

• JWT tokens expire after 24 hours
• Passwords are bcrypt-hashed
• CORS configured for localhost origins (update for production)
• API keys stored in .env (never committed)
• Demo credentials are for development only

📄 License

MIT License — see LICENSE for details. "# ThreatView-"