Local, offline and deterministic Cyber Threat Intelligence analysis powered by MITRE ATT&CK.
Odysafe Threatmap helps CTI analysts turn local threat reports into structured intelligence, Excel workbooks and MITRE ATT&CK views.
It is designed for analysts who want results that are:
- local
- explainable
- reproducible
- auditable
- ATT&CK-based
- easy to share
No LLM. No cloud analysis. No automatic threat attribution. No hidden guessing.
Odysafe Threatmap generates analyst-ready Excel workbooks with CTI dashboards, IOCs, MITRE ATT&CK techniques, tactics, detection information, mitigations and provenance.
Odysafe can help you:
| You have | You want | Use |
|---|---|---|
| One CTI report | Extract IOCs and explicit ATT&CK intelligence | report build |
| One threat actor | Explore its ATT&CK knowledge | actor snapshot |
| Several actors | Compare techniques, software and campaigns | actor snapshot with several actors |
| One industry sector | Build a sector threat profile | sector profile |
| Many reports | Find repeated IOCs, TTPs and duplicates | aggregate |
| A report + Sigma rules | Find detection coverage and gaps | coverage sigma |
| Actor/report/sector ATT&CK data | Generate Navigator layers | navigator |
| Local ATT&CK data | Inspect or validate it | data |
| An Odysafe installation | Check that everything works | doctor |
Odysafe works with local files.
Once the MITRE ATT&CK dataset has been installed:
Local CTI report
│
▼
Odysafe
│
▼
Local MITRE ATT&CK
│
▼
Excel / Navigator output
Normal analysis does not need to send your CTI reports to a remote service.
Network access is mainly needed when you explicitly install or update MITRE ATT&CK data.
Odysafe announces network access before downloading ATT&CK.
Odysafe is intentionally conservative.
For example:
PowerShell was executed.
does not automatically become:
T1059.001
For Report analysis, the ATT&CK identifier must be explicitly present in the report.
Example:
The activity was mapped to T1059.001.
Now Odysafe can validate and enrich that ATT&CK ID.
This makes the result easier to verify against the original report.
Recommended environment:
Linux
Python 3.11+
Internet access for the initial ATT&CK download
Once ATT&CK is installed, the main CTI analysis workflows are designed to work locally.
git clone https://github.com/YOUR-USERNAME/odysafe-threatmap.git
cd odysafe-threatmapReplace the repository URL with the real Odysafe GitHub repository.
If required:
chmod +x install.sh start.sh uninstall.shRun:
./install.shThe installer creates the Python environment and installs the project dependencies.
Example:
Odysafe ThreatMap
Private. Offline. Ready when you are.
Installing from current source tree…
Creating virtual environment at: .venv
The environment can also be activated manually with:
source .venv/bin/activateDuring installation, Odysafe asks which ATT&CK dataset you want to use.
Example:
✦ MITRE ATT&CK DATA
1 ↻ Latest official dataset
2 ↓ Specific release
3 Set up later
For most users:
1 — Latest official dataset
is the easiest choice.
Odysafe then asks before using the network.
Example:
Network access is required once.
Download now? [Y/n]:
If you answer:
Y
Odysafe downloads the official Enterprise ATT&CK STIX bundle, validates it and builds the local index.
After that, the dataset is stored locally.
After installation, there are two easy ways to start the application.
From the repository:
./start.shThis is the simple launcher.
You can also run:
odysafeThis opens the interactive Odysafe menu.
You can also explicitly run:
odysafe interactiveFor most users, this is the recommended way to start.
odysafeThe main menu provides actions such as:
[1] 🔎 Inspect MITRE data
[2] ↻ Update MITRE data
[3] ↓ Install a MITRE release
[4] ✦ Run analysis / generation
[5] ♥ Check installation health
[6] × Quit
Choose:
4
to open the Analysis Studio.
The guided Analysis Studio provides:
[1] 📄 REPORT WORKBOOK
[2] 👤 ACTOR SNAPSHOT
[3] 🏢 SECTOR PROFILE
[4] 🗂 AGGREGATE REPORTS
[5] 🛡 SIGMA COVERAGE
The guided interface explains:
- what the function does
- what files you need
- optional information
- what will be generated
- important limitations
- available local files
This is useful if you do not want to remember CLI commands.
Odysafe uses simple local folders for the guided interface.
odysafe-input/
├── reports/
└── sigma/
Put local CTI reports in:
odysafe-input/reports/
Supported report formats include:
.txt
.html
.htm
.pdf
.docx
Example:
odysafe-input/
└── reports/
├── apt29-report.pdf
├── cert-alert.txt
└── vendor-analysis.docx
Put Sigma rules in:
odysafe-input/sigma/
Supported formats:
.yml
.yaml
Example:
odysafe-input/
└── sigma/
├── powershell.yml
├── suspicious_network.yml
└── credential_dumping.yaml
Generated files are normally written under:
odysafe-output/
Example:
odysafe-output/
├── report_vendor-analysis.xlsx
├── actor_APT29.xlsx
├── actor_comparison_*.xlsx
├── aggregate.xlsx
├── sigma_coverage_report.xlsx
├── navigator_actor-presence.json
└── sectors/
└── sector_financial.xlsx
Odysafe avoids silently overwriting an existing analysis file.
To see all available commands:
odysafe --helpTo check the installed version:
odysafe --versionodysafe report build report.txtOdysafe reads one local CTI report and extracts explicit intelligence.
It can identify information such as:
IP addresses
domains
URLs
email addresses
hashes
CVEs
explicit MITRE ATT&CK IDs
explicitly identified ATT&CK actors
It then enriches valid ATT&CK IDs with the local ATT&CK dataset.
odysafe report build ./odysafe-input/reports/acme-incident.pdfAn Excel workbook containing information such as:
📊 Executive dashboard
📄 Report information
🌐 IOC summary
🌐 IOC details
🎯 ATT&CK techniques
🗺 Tactic coverage
🔎 Detection information
🛡 Mitigations
👥 Related ATT&CK context
🔐 Provenance
Report analysis can also include analyst-provided metadata.
Examples include:
report name
source / publisher
report date
TLP
confidence
output directory
A command can conceptually look like:
odysafe report build report.pdf \
--name "September intrusion investigation" \
--source "Internal SOC" \
--date 2026-09-05 \
--tlp AMBER \
--confidence "High"Use:
odysafe report build --helpto see the exact options supported by your installed version.
Use this when you already know which threat group you want to investigate.
odysafe actor snapshot APT29odysafe actor snapshot G0016Odysafe can resolve:
ATT&CK group IDs
canonical group names
exact aliases
The actor workbook can contain:
👤 Actor identity
🏷 Aliases
🎯 Direct ATT&CK techniques
🧰 Software / malware
📅 Explicit campaigns
🌍 Local metadata when configured
📊 Dashboard
🔐 Provenance
Pass several actors to the same command.
Example:
odysafe actor snapshot APT29 Kimsuky OilRigOdysafe creates a comparison workbook instead of a simple actor profile.
It can help compare:
shared techniques
different techniques
software
campaigns
ATT&CK coverage
This is useful for CTI research.
It is not automatic threat attribution.
Odysafe does not say:
Incident TTPs look like APT29
therefore APT29 caused the incident
Use this when you want to study threats relevant to a configured sector.
Example:
odysafe sector profile financialYou can also request several sectors:
odysafe sector profile financial energy technologySector profiles combine:
local actor ↔ sector configuration
+
MITRE ATT&CK group relationships
+
ATT&CK techniques and tactics
One Excel workbook per sector, with information such as:
📊 Sector dashboard
👥 Relevant configured threat actors
🎯 ATT&CK techniques
🗺 Tactics
⚠ Priorities / risk information
🌍 Region information when configured
🔐 Provenance
Sector membership is not guessed from ATT&CK descriptions.
It comes from explicit Odysafe local configuration.
Use Aggregate when you have several CTI reports.
Example directory:
reports/
├── cert-fr.txt
├── microsoft-report.pdf
├── vendor-a.docx
└── vendor-b.html
Run:
odysafe aggregate ./reportsOdysafe processes the reports together and can identify:
number of reports
exact duplicate reports
unique IOCs
repeated IOCs
unique ATT&CK techniques
repeated ATT&CK techniques
source provenance
corroboration status
If your reports are inside subdirectories:
odysafe aggregate ./reports --recursiveExample structure:
reports/
├── cert/
│ └── alert.txt
├── vendors/
│ ├── vendor1.pdf
│ └── vendor2.pdf
└── internal/
└── incident.docx
--recursive tells Odysafe to scan subdirectories too.
Several reports repeating the same information do not always represent several independent sources.
Example:
CERT-FR
│
├── copied by Blog A
├── copied by Blog B
└── copied by Vendor Newsletter
That is still one original primary source.
Odysafe can use a source-mapping CSV.
Example:
file,primary_source
cert.txt,CERT-FR
blog-a.txt,CERT-FR
blog-b.txt,CERT-FR
microsoft.txt,MicrosoftRun:
odysafe aggregate ./reports --sources sources.csvMeans:
same evidence
+
at least two different primary sources
Example:
T1071.001
├── CERT-FR
└── Microsoft
Result:
MULTI-SOURCE
Example:
T1071.001
├── report-a.txt → CERT-FR
├── report-b.txt → CERT-FR
└── report-c.txt → CERT-FR
Three files exist, but the evidence comes from the same primary source.
Result:
FALSE CORROBORATION
If source mapping is missing or incomplete:
INDETERMINATE
Odysafe does not invent source independence.
Use this when you want to compare CTI techniques with your local Sigma detection rules.
You need:
one CTI report
+
one directory of Sigma rules
Example:
odysafe coverage sigma \
./odysafe-input/reports/report.txt \
./odysafe-input/sigmaExample report:
T1059.001
T1071.001
T1105
T1041
Example Sigma tags:
attack.t1059.001
attack.t1071.001
Odysafe compares the explicit ATT&CK mappings.
The Excel workbook can show:
🟢 Exact coverage
🟡 Partial coverage
🔴 Not covered
along with matching Sigma rules.
Odysafe does not inspect a Sigma title like:
Suspicious PowerShell
and decide automatically:
T1059.001
ATT&CK coverage is based on explicit Sigma ATT&CK tags.
Odysafe can generate ATT&CK Navigator JSON layers.
Navigator is useful for:
CTI presentations
SOC reviews
ATT&CK coverage
purple-team work
threat visualization
odysafe navigator actor APT29This can create actor-focused layers such as:
presence
frequency
mitigations
odysafe navigator report report.txtThis creates layers from the explicit ATT&CK techniques in the report.
odysafe navigator sector financialThis creates sector-oriented ATT&CK layers.
Depending on the workflow, generated layers can represent:
presence
frequency
mitigation
risk
Odysafe keeps ATT&CK locally.
To see the available data commands:
odysafe data --helpRun:
odysafe data statusThis shows information such as:
ATT&CK bundle path
source type
source reference
ATT&CK release
STIX version
mitreattack-python version
SHA-256
cache status
configuration hash
Use this when you want to know:
Which exact ATT&CK dataset is Odysafe using?
Run:
odysafe data inspectThis provides deeper information about the installed bundle.
It can show information such as:
compatibility status
STIX version
ATT&CK domain
object types
relationship types
detection model
schema/spec information
This is especially useful for debugging or validating a new ATT&CK release.
The easiest method is:
odysafeThen choose:
UPDATE MITRE DATA
Odysafe announces the network operation before downloading.
For direct command options, run:
odysafe data --helpand:
odysafe data update --helpYou can also install a specific ATT&CK release.
The easiest method is through:
odysafethen:
INSTALL A MITRE RELEASE
Example release:
19.2
For the exact direct-CLI syntax supported by the installed version:
odysafe data --helpRun:
odysafe doctorThis verifies the main Odysafe environment.
Checks can include:
Python
mitreattack-python
iocsearcher
txt2stix
XlsxWriter
STIX support
ATT&CK local data
technique lookup
group lookup
tactics
mitigations
detection strategy
data components
cache
configuration
Excel writing
Navigator support
If you are not sure whether your installation is healthy, this should be one of the first commands you run.
Check Odysafe version:
odysafe --versionExample:
1.1.0
Main help:
odysafe --helpCommand-specific help:
odysafe report --helpodysafe report build --helpodysafe actor --helpodysafe actor snapshot --helpodysafe sector --helpodysafe sector profile --helpodysafe aggregate --helpodysafe coverage --helpodysafe navigator --helpodysafe data --helpThese commands are the best way to see all flags supported by your installed version.
| Command | What it does | Main output |
|---|---|---|
./install.sh |
Install Odysafe and dependencies | Local environment |
./start.sh |
Start Odysafe | Interactive interface |
./uninstall.sh |
Safely remove Odysafe environment/data after confirmation | Removal |
odysafe |
Open main interactive menu | Interactive UI |
odysafe interactive |
Open interactive menu explicitly | Interactive UI |
odysafe --version |
Show installed version | Version |
odysafe --help |
Show commands | Help |
odysafe doctor |
Validate installation | Health report |
odysafe data status |
Show installed ATT&CK snapshot | ATT&CK status |
odysafe data inspect |
Inspect ATT&CK capabilities | Compatibility report |
odysafe report build FILE |
Analyse one CTI report | Excel workbook |
odysafe actor snapshot ACTOR |
Analyse one ATT&CK actor | Excel workbook |
odysafe actor snapshot A B |
Compare several actors | Comparison workbook |
odysafe sector profile SECTOR |
Build a sector threat profile | Excel workbook |
odysafe aggregate DIR |
Aggregate multiple reports | Excel workbook |
odysafe aggregate DIR --recursive |
Include subdirectories | Excel workbook |
odysafe aggregate DIR --sources FILE.csv |
Add primary-source mapping | Corroboration workbook |
odysafe coverage sigma REPORT SIGMA_DIR |
Compare TTPs with Sigma coverage | Excel workbook |
odysafe navigator actor ACTOR |
Build actor Navigator layers | JSON |
odysafe navigator report FILE |
Build report Navigator layers | JSON |
odysafe navigator sector SECTOR |
Build sector Navigator layers | JSON |
Use:
odysafe report build report.pdfYou get:
IOCs
ATT&CK TTPs
tactics
detection information
mitigations
provenance
Excel dashboard
Use:
odysafe actor snapshot APT29You get:
aliases
direct TTPs
software
campaigns
actor workbook
Use:
odysafe actor snapshot APT29 KimsukyYou get:
multi-actor comparison workbook
Use:
odysafe sector profile financialYou get:
configured relevant actors
ATT&CK techniques
tactics
risk/priorities
sector workbook
Put them in:
odysafe-input/reports/
Then:
odysafe aggregate ./odysafe-input/reportsYou get:
report inventory
duplicates
unique IOCs
repeated IOCs
unique TTPs
repeated TTPs
provenance
corroboration
Use:
odysafe aggregate ./reports --recursiveCreate:
sources.csv
Then:
odysafe aggregate ./reports --sources sources.csvOdysafe can distinguish:
MULTI-SOURCE
FALSE CORROBORATION
INDETERMINATE
Use:
odysafe coverage sigma report.txt ./sigmaYou get:
exact coverage
partial coverage
not covered
matching rules
Use:
odysafe navigator actor APT29You get one or several:
.json
Navigator layers.
Use:
odysafe doctorUse:
odysafe data statusVendor / CERT / Internal report
│
▼
REPORT WORKBOOK
│
┌───────┼─────────┐
│ │ │
IOCs TTPs Actor context
│
▼
MITRE ATT&CK
│
┌─────┴─────┐
▼ ▼
Mitigations Detection
CERT
Vendor A
Vendor B
Internal SOC
Research report
│
▼
AGGREGATE
│
├── duplicates
├── repeated IOCs
├── repeated TTPs
├── primary sources
└── corroboration
Threat report
│
▼
Explicit ATT&CK IDs
│
▼
Sigma rules
│
▼
SIGMA COVERAGE
│
├── exact
├── partial
└── missing
Odysafe focuses heavily on analyst-friendly Excel output.
Depending on the workflow, workbooks can include:
Dashboards
KPIs
Tables
Charts
IOCs
TTPs
Tactics
Actors
Software
Campaigns
Mitigations
Detection information
Risk / priorities
Corroboration
Provenance
Technical provenance is kept so analysts can understand which ATT&CK data and inputs were used.
Odysafe aims to make generated intelligence traceable.
Outputs can track information such as:
Odysafe version
generation time
ATT&CK snapshot
ATT&CK SHA-256
configuration hash
input hashes
source information
This helps answer questions such as:
Which ATT&CK dataset was used?
Which report produced this IOC?
Can I reproduce this analysis later?
Odysafe is not intended to be:
an LLM assistant
a malware sandbox
a SIEM
a full Threat Intelligence Platform
an automatic attribution engine
an automatic semantic ATT&CK mapper
For example:
PowerShell was used
does not automatically mean:
T1059.001
And:
These techniques look like APT29
does not mean:
APT29 is the attacker
Odysafe prefers:
UNKNOWN
N/A
INDETERMINATE
over unsupported conclusions.
From the repository root:
./uninstall.shThe removal script asks for confirmation before removing the Odysafe environment, settings, local data and caches.
Example:
Odysafe ThreatMap
Safe removal
Remove Odysafe ThreatMap, environments, settings, data, and caches? [y/N]:
Be careful before answering:
y
because local Odysafe data can be removed.
Try:
source .venv/bin/activatethen:
odysafe --versionYou can also start with:
./start.shRun:
odysafeand choose:
INSTALL A MITRE RELEASE
or:
UPDATE MITRE DATA
Then check:
odysafe data statusRun:
odysafe doctorCheck:
ls -lah odysafe-input/reports/Supported report types:
TXT
HTML
PDF
DOCX
Check:
ls -lah odysafe-input/sigma/Supported:
.yml
.yaml
Odysafe Threatmap would not be possible without the work of the open-source cybersecurity community.
A special thank you to the developers, maintainers and contributors behind these projects.
IOC and cyber-observable extraction from threat reports.
https://github.com/malicialab/iocsearcher
The threat knowledge base used by Odysafe for techniques, tactics, groups, software, campaigns, mitigations and detection information.
Python tools used to work with MITRE ATT&CK STIX data.
https://github.com/mitre-attack/mitreattack-python
The Structured Threat Information Expression standard maintained through OASIS.
https://oasis-open.github.io/cti-documentation/
Open-source tooling for converting CTI reports into structured STIX intelligence.
https://github.com/muchdogesec/txt2stix
Open detection-rule format and ecosystem.
https://github.com/SigmaHQ/sigma
Used to generate Excel workbooks, dashboards, tables and charts.
https://xlsxwriter.readthedocs.io/
Used for the terminal user interface.
Used to build the command-line interface.
Thank you to every developer and contributor who shares tools, standards, data and knowledge with the cybersecurity community.
Odysafe does not replace these projects.
It brings them together into a local workflow focused on CTI analysts.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.
Odysafe Threatmap is an independent project and is not affiliated with or endorsed by The MITRE Corporation, OASIS, MaliciaLab, DOGESEC, SigmaHQ or the maintainers of the projects listed above.
Turn local threat reports into structured, auditable MITRE ATT&CK intelligence — without sending your reports to the cloud and without asking an AI to guess what they mean. s