Fragmented Intelligence
Indicators and supporting evidence are distributed across multiple platforms.
Open-source threat intelligence workbench
From Indicators to Intelligence.
MANTIS brings threat knowledge, continuous intelligence monitoring, YARA workflows, malware analysis, and evidence-aware AI into a single workspace built for security researchers.
The challenge01 02 03
Threat Intelligence Is Fragmented.
Investigating a threat often means moving between knowledge bases, ransomware feeds, malware repositories, YARA tools, disassemblers, and reporting workflows.
Manual Investigation
Researchers repeatedly switch tools to research actors, monitor ransomware, compare samples, and validate YARA rules.
Disconnected Findings
Connecting actors, malware, samples, rules, and threat activity requires additional analysis and correlation.
MANTIS brings these workflows together.
Capabilities
Purpose-Built Workbenches for Security Research.
Move from threat knowledge and live monitoring into rule development, malware comparison, and structured binary analysis without leaving the investigation workspace.
01
Threat Knowledge Base
Research known threat actors, activity clusters, malware families, and security tooling using MISP Galaxy, Malpedia, Microsoft, Tidal, and Kaspersky TIP context.
02
Ransomware Monitor
Track recent victims, groups, trends, affected sectors, ransom notes, cryptocurrency addresses, IOCs, and watchlist matches.
03
YARA Toolkit
Search local and synchronized rules, scan samples, and move into a dedicated workbench for rule authoring and testing.
04
Malware Similarity
Compare samples using strings, imports, functions, basic blocks, and optional IDA or Hex-Rays features to support manual clustering.
05
AI Binary Analysis & Reporting
Analyze PE, ELF, Mach-O, and .NET samples with supported IDA Pro or Ghidra workflows, then create Markdown, HTML, and PDF reports or portable AI workspace bundles.
06
YARA Rule Workbench
Write, validate, test, explain, and safely refine YARA rules against files, paths, uploaded samples, or local corpora.
Continuous intelligence & AI
Monitor the signal. Turn evidence into reporting.
Collect daily intelligence and emerging signals from articles, vulnerabilities, X, and Telegram—then use MANTIS AI to organize evidence and communicate findings.
07
Today's Intelligence
Review a consolidated daily view of CTI articles, exploited vulnerabilities, new PoCs, ransomware activity, regional signals, and social intelligence.
08
CTI Articles
Build a searchable local article library from synchronized RSS feeds, preserved metadata, extracted indicators, and MANTIS AI summaries.
09
Vulnerability Intelligence
Track PoC availability, trending exploit repositories, CISA KEV entries, severity and references, plus malicious-package intelligence from OSV.
10
X Monitor
Follow configured researchers and CTI accounts for early vulnerability, PoC, malware, campaign, infrastructure, and actor signals.
11
Telegram Toolkit
Monitor authenticated channels, collect messages, and surface IOCs, credentials, archives, victim mentions, and target artifacts for investigation.
12
MANTIS AI
Work over collected evidence to summarize findings, connect relationships, guide passive pivots, assess attribution evidence, and draft investigation reports.
Open-source landscape
How MANTIS Compares.
Each project solves a valuable part of the threat-intelligence workflow. MANTIS is differentiated by bringing collection, investigation, malware workbenches, and evidence-aware reporting together in a single analyst-focused environment.
✓ Built-in◐ Partial / integration— Not included
| Project | Primary focus | IOC & OSINT enrichment | CTI knowledge | Continuous monitoring | YARA & malware analysis | Social / Telegram | AI & reporting |
|---|---|---|---|---|---|---|---|
| MANTISThis project | Unified analyst workbench | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| IntelOwl | IOC and file enrichment | ✓ | ◐ | ◐ | ✓ | — | ◐ |
| OpenCTI | STIX knowledge graph | ◐ | ✓ | ◐ | — | ◐ | ◐ |
| MISP | Intelligence sharing | ✓ | ✓ | ✓ | ◐ | ◐ | ◐ |
| YETI | CTI and DFIR enrichment | ✓ | ✓ | ◐ | ◐ | — | — |
| SpiderFoot | OSINT and attack-surface mapping | ✓ | ◐ | ◐ | — | ◐ | — |
| OpenOSINT | AI-assisted passive OSINT | ✓ | ◐ | — | — | ◐ | ✓ |
| Watcher | AI-powered CTI monitoring | ◐ | ◐ | ✓ | — | — | ✓ |
Based on publicly documented open-source capabilities as of November 2026. Integrations and available features may change.
One investigation surface
MANTIS combines IOC enrichment, threat knowledge, daily intelligence, ransomware, vulnerability, X, and Telegram monitoring in one local workspace.
Built-in analyst workbenches
YARA authoring and testing, sample similarity, and IDA or Ghidra-backed binary analysis are first-class workflows rather than external handoffs.
Evidence-aware reporting
MANTIS AI works over collected evidence and supports daily briefs, investigation reports, and Binary Lab output in Markdown, HTML, PDF, and portable workspace bundles.
Investigation flow
From One Indicator to a Broader Investigation.
Start with a single indicator and follow the evidence through enrichment, discovery, pivoting, and analysis.
- 01
Acquire
Collect intelligence from configured sources.
- 02
Enrich
Normalize and correlate collected information.
- 03
Discover
Identify related indicators, infrastructure, and artifacts.
- 04
Pivot
Expand the investigation using supporting evidence.
- 05
Analyze
Review relationships and generate findings.
- 06
Report
Export findings for analysis or reporting.
Product
Workbenches Built for Real Investigations.
Explore the actual MANTIS knowledge, daily intelligence, CTI, vulnerability, social-monitoring, evidence-aware AI, YARA, similarity, and binary-reporting interfaces.
Workspace / 01
Threat Actor Knowledge
Search known actors and activity clusters, review aliases and references, and pivot names back into MANTIS investigations.
Workspace / 02
Ransomware Monitor
Monitor victims, groups, regional and sector trends, ransom notes, cryptocurrency addresses, IOCs, and watchlist activity.
Workspace / 03
Today's Intelligence
Bring CTI articles, vulnerability activity, PoCs, ransomware, regional events, and social signals into one daily operational view.
Workspace / 04
Vulnerability Intelligence
Prioritize vulnerabilities using public PoCs, trending exploit repositories, CISA KEV context, severity, references, and OSV package intelligence.
Workspace / 05
Telegram Toolkit
Monitor authenticated channels and review collected messages for IOCs, credentials, archives, victim mentions, target references, and investigation artifacts.
Workspace / 06
Evidence-Aware MANTIS AI
Summarize collected evidence, examine relationships, guide passive pivots, and produce structured intelligence reporting while keeping source context visible.
Workspace / 07
YARA Rule Workbench
Write, validate, test, explain, and save YARA rules through supported local workflows.
Workspace / 08
Malware Similarity
Compare new samples with defined malware or threat-actor entities and inspect shared static characteristics.
Workspace / 09
AI Binary Analysis & Reporting
Review AI-assisted malware findings and generate Markdown notes, interactive HTML, downloadable PDF reports, or portable AI workspace bundles.
Integrations
Connect the Intelligence Sources You Already Use.
Combine built-in local datasets, keyless public lookups, and optional API-backed intelligence providers.
01VirusTotal
02AlienVault OTX
03Abuse.ch
04Shodan
05Censys
06URLScan.io
07MISP
08Kaspersky TIP
09Hybrid Analysis
10Hatching Triage
Integrations may require individual API keys, subscriptions, or external services.
Complete source catalog
56 sources. One investigation workspace.
Censys
Common Crawl
CTI Articles
CyberBriefing
DNSDumpster
Driftnet
Etugen
FOFA
GitHubGitHub CodeGitHub Threat Intel Repos
GreyNoise
Hybrid Analysis
Internet Archive
LeakIXLocal RSSLocal YARA RulesMalware & Tools
Malware.News
MalwareBazaar
MISP GalaxyMISP Intelligence
NetlasOpenPhish
ORKL CTI
PhishStats
Pulsedive
RansomLook.ioRansomware Monitor YARA
Ransomware.liveReputation Feeds
RIPEstat
SANS ISC
Shodan
Silent PushThreat Actor
ThreatBook Community
ThreatFoxThreatMinerTriage Sandbox
TweetFeedTwitterTwitter/X
URLhaus
URLScan.ioValidin
VirusTotalVulnerability IntelligenceX Monitor
YARAify
ZoomEyeProvider marks and site icons identify external services. The MANTIS badge identifies local workbenches; a neutral source mark is used where no reusable provider icon is available.
Local-first operation
Your Investigation. Your Environment.
MANTIS runs as a locally hosted application and stores core investigation artifacts in local databases and files. When you enable external intelligence or AI providers, relevant queries and context are sent to those configured services.
- Locally hosted web application
- Local investigation data and generated artifacts
- Optional external intelligence integrations
- Local or external AI configurations where supported
Local environment
Analyst browserMANTIS Workspace
On this hostLocal data
When enabledExternal APIs
External communication occurs only for configured provider lookups, collection tools, or AI services—not every MANTIS workflow is offline.
Quick start
Get Started with MANTIS.
MANTIS recommends Python 3.10 or newer and a modern browser. Optional analysis and monitoring features may require their own native tools or credentials.
Read complete installation documentation Setup
PowerShell / Command Prompt
run.batStarts FastAPI at http://127.0.0.1:9999 by default.
Shell
chmod +x start_linux.sh
./start_linux.shStarts the backend on port 8000 and frontend on port 8080.
Open source
Open Source. Built for Researchers.
MANTIS is an open-source project designed to support practical threat intelligence investigations and security research.
Begin an investigation
Start Investigating with MANTIS
Explore the source code, set up your investigation environment, and start connecting intelligence across multiple sources.