🕵️ Cyber Security & Forensic Science Intelligence Multi-Agent System

An autonomous, 24/7 multi-agent threat intelligence and digital forensics curation desk. It scrapes authoritative open-source repositories, evaluates and scores pending investigations based on evidence and methodology, and presents a curated Top 5 Case Studies Board for you to select 2 active cases to research.

🤖 The 3-Agent Architecture

┌────────────────────────────────────────────────────────┐
│   Agent 1: 24/7 Intelligence Harvester                 │
│   • CISA Cyber Incident Advisories                     │
│   • Bellingcat OSINT Investigations                    │
│   • DFIR Review Peer-Reviewed Forensics               │
│   • FBI Major Cases & Cyber Fugitives                  │
│   • GitHub Forensic Repositories                       │
└──────────────────────────┬─────────────────────────────┘
                           │ Ingests raw case studies
┌──────────────────────────▼─────────────────────────────┐
│   Agent 2: Forensics Evaluator & Structurer            │
│   • Scores each case (0–100) on 5 Metrics:             │
│     1. Evidence Quality (Artifacts/Logs/PCAP)          │
│     2. Completion % & Pending Stage (40-60% optimal)   │
│     3. Threat Actors & Person Attribution              │
│     4. Due Period & Freshness                          │
│     5. Public Impact & Infrastructure                  │
│   • Structures into 4-Part Analyst Framework           │
└──────────────────────────┬─────────────────────────────┘
                           │ Stores in SQLite Vault
┌──────────────────────────▼─────────────────────────────┐
│   Agent 3: Lead Intelligence Supervisor                │
│   • Curates the Top 5 Ranked Cases                     │
│   • You select 2 cases to start working on             │
│   • Generates full Dossiers + Ready-to-Post Drafts     │
└────────────────────────────────────────────────────────┘

📁 Project Structure

cyber-intel-agent/
├── main.py                  # CLI controller (Interactive / 24/7 Daemon / Sweep)
├── agent_harvester.py       # Agent 1: 24/7 web scraping & feed polling
├── agent_evaluator.py       # Agent 2: 5-point evaluation & 4-part structuring
├── agent_supervisor.py      # Agent 3: Top 5 curation & dossier generator
├── db.py                    # SQLite state engine (intel_vault.db)
├── requirements.txt         # Dependencies (feedparser, bs4, rich, apscheduler)
└── dossiers/                # Generated investigative dossiers and social drafts

⚡ Quick Start

Option A: Via NPM / NPX (Any Laptop or Linux Server)

# Launch interactive btop-like containerized dashboard (Arrow keys + Enter):
npx cintel-cli

# Or install globally:
cintel              # Launches full-screen btop-style TUI
cintel status       # Static terminal SOC snapshot
cintel sweep        # Force live pull across all feeds
cintel story next   # Generate next day's Corporate Story + candid 35mm photo
cintel story list   # View archive of corporate stories
cintel story publish # Queue corporate story directly to LinkedIn

Option B: Local Python Setup

pip install -r requirements.txt

2. Choose Your 2 Cases (Interactive Mode)

python main.py

• Agent 3 displays a rich terminal table with the Top 5 Curated Cases.
• Enter two numbers (e.g., 1 3) to select the cases you want to prioritize.
• Full investigation dossiers and ready-to-post LinkedIn/X drafts will be generated in dossiers/!

3. Run the 24/7 Background Harvester Daemon

python main.py daemon

• Monitors CISA, Bellingcat, DFIR Review, and GitHub feeds around the clock (every 60 minutes).
• Automatically scores and catalogs incoming intelligence into intel_vault.db.

4. Run a One-Time Intelligence Sweep

python main.py sweep

📋 The 4-Part Investigation Analyst Template

Each generated dossier adheres to professional intelligence standards:

1. Case Background: Who reported it, what is known, and initial scope.
2. Evidence & Forensic Artifacts: Detailed breakdown of memory dumps, logs, registry keys, PCAPs, and satellite telemetry.
3. Investigative Hypotheses: Working theories tested against primary telemetry.
4. Gaps & Next Steps: What remains unsolved, missing artifacts, and open research questions.
5. Social Publishing Draft: Ready-to-copy thought leadership posts for LinkedIn and X.