About

<h1 align="center">Cyberbro</h1>

<p align="center">
<img src="https://github.com/user-attachments/assets/5e5a4406-99c1-47f1-a726-de176baa824c" width="90" /><br />
<b><i>A simple application that extracts your IoCs from garbage input and checks their reputation using multiple services.</i></b>
<br />
<b>🌐 <a href="https://demo.cyberbro.net/">demo.cyberbro.net</a></b><br />

</p>

---

<p align="center">
  <a href="https://github.com/stanfrbd/cyberbro/stargazers">
    <img src="https://img.shields.io/github/stars/stanfrbd/cyberbro?style=social" alt="GitHub stars">
  </a>
  <a href="https://x.com/cyberbro_cti">
    <img src="https://img.shields.io/twitter/follow/cyberbro_cti?style=social" alt="Follow on X/Twitter">
  </a>
  <a href="https://infosec.exchange/@cyberbro">
    <img src="https://img.shields.io/badge/Follow_@cyberbro-23-blue?logo=mastodon" alt="Mastodon">
  </a>
  <a href="https://github.com/stanfrbd/cyberbro/issues">
    <img src="https://img.shields.io/github/issues/stanfrbd/cyberbro" alt="GitHub issues">
  </a>
  <a href="https://github.com/stanfrbd/cyberbro/blob/main/LICENSE">
    <img src="https://img.shields.io/github/license/stanfrbd/cyberbro" alt="License">
  </a>
  <a href="https://github.com/stanfrbd/cyberbro/actions/workflows/jobs.yml">
    <img src="https://github.com/stanfrbd/cyberbro/actions/workflows/jobs.yml/badge.svg" alt="build and test badge">
  </a>
  <a href="https://github.com/stanfrbd/cyberbro/actions/workflows/pre-commit-validation.yml">
    <img src="https://github.com/stanfrbd/cyberbro/actions/workflows/pre-commit-validation.yml/badge.svg" alt="pre-commit validation badge">
  </a>
  <a href="https://www.python.org/">
    <img src="https://img.shields.io/badge/Python-3.13-blue?logo=python" alt="Python">
  </a>
</p>

---

# About

Inspired by [Cybergordon](https://cybergordon.com/) and [IntelOwl](https://github.com/intelowlproject/IntelOwl).

This project aims to provide a simple and efficient way to check the reputation of your observables using multiple services,
without having to deploy a **complex** solution. Read the docs at https://docs.cyberbro.net/

> [!TIP]
> To build custom reports, use Cyberbro with your favorite **LLM** (Claude, OpenAI gpt-5...) via **MCP** (Model Context Protocol) \
> Checkout [Cyberbro MCP](https://github.com/stanfrbd/mcp-cyberbro) for more information.

# Demo

![graph_demo](https://github.com/user-attachments/assets/9116b9d8-ae81-4ff7-a6c3-b613929490ca)

# Features

* **Easy Input**: Paste raw logs or IoCs-automatic parsing and extraction.
* **Multi-Service Checks**: Reputation lookup for IPs, hashes, domains, URLs, and Chrome extension IDs across many threat intel services.
* **Comprehensive Reports**: Advanced search, filtering, and export to CSV/Excel.
* **Fast Processing**: Multithreaded for speed.
* **Automated Pivoting**: Discover related domains, URLs, and IPs via reverse DNS and RDAP.
* **Accurate Domain & Abuse Info**: ICANN RDAP and abuse contact lookups.
* **Integrations**: Microsoft Defender for Endpoint, CrowdStrike, OpenCTI, Grep.App, Hudson Rock, and more.
* **Proxy & Storage**: Proxy support and results stored in SQLite.
* **History & Graphs**: Analysis history and experimental graph view.
* **Cache**: Caching for faster repeat lookups (enabled at multi-engines level, not each engine).

# What Makes Cyberbro Unique

* **Beginner-Friendly**: Accessible for all skill levels.
* **Chrome Extension ID Lookup**: Get extension names and CTI data from IDs.
* **Lightweight Deployment**: Simple setup and use.
* **Advanced TLD Extraction**: Accurate root domain detection for better lookups.
* **Pragmatic Data Gathering**: Uses GitHub and Google to find overlooked IoCs.
* **CTI Report Integration**: Fetches IoC-related reports from IoC.One.
* **EDR Integration**: Checks observables against your own security tools (MDE, CrowdStrike).

# Getting Started - TL;DR

> [!TIP]
> If you are lazy, you need Docker. \
> Do a `git clone` ; copy `secrets-sample.json` to `secrets.json` ; `docker compose up` then go to `localhost:5000`. Yep, that's it!

# Getting Started

* To get started, clone the repository

```bash
git clone https://github.com/stanfrbd/cyberbro
cd cyberbro
```

## Edit the config file (mandatory)

```
cp secrets-sample.json secrets.json
```

> [!NOTE]
> Don't have API keys? No problem, just copy the `secrets-sample.json` to `secrets.json` and leave all like this. Be careful if a proxy is used. \
> You will be able to use **all free engines!**

* Fill values (including proxy if needed) in the `secrets.json` file.

```json
{
    "abuseipdb": "token_here",
    "alienvault": "token_here",
    "criminalip_api_key": "token_here",
    "crowdstrike_client_id": "client_id_here",
    "crowdstrike_client_secret": "client_secret_here",
    "dfir_iris_api_key": "token_here",
    "dfir_iris_url": "https://dfir-iris.local",
    "google_cse_cx": "cx_here",
    "google_cse_key": "key_here",
    "google_safe_browsing": "token_here",
    "ipapi": "tok

... (truncated)