Cyber Intel Teaching Converter

A small, local Streamlit app that turns an unclassified cyber report into instructor-ready teaching material. Paste a report, click Analyze, and the app calls the OpenAI API and returns a structured breakdown you can drop straight into a lesson.

What it produces

For each report the app returns:

• BLUF — bottom line up front

• Key entities — actors, victims, tools, infrastructure, orgs

• Timeline — reconstructed sequence of events

• Capability / Intent / Target matrix — actor vs. victim

• Diamond Model mapping — adversary, capability, infrastructure, victim (+ meta-features)

• Tentative ATT&CK tactics — each with a confidence level and a note explaining it

• PIRs and EEIs — priority intelligence requirements and their essential elements

• Intelligence gaps — what the report leaves unknown

• Operational relevance — why a defender/operator should care

• Teaching points — discrete lesson takeaways

• Three discussion questions

• A short classroom vignette an instructor can read aloud

• One slide takeaway — a single headline line

⚠️ UNCLASSIFIED USE ONLY. Paste only unclassified, releasable text. Do not enter classified, CUI, or otherwise sensitive/proprietary material — the input is sent to the OpenAI API.

Related MCP server: Suunto MCP

Privacy

The app stores nothing. Report text is held only in the current Streamlit session's memory while the app runs, and is sent to OpenAI solely to generate the analysis. There is no database, no logging of report contents, and no local file is written with your input.

Requirements

• Python 3.9+

• An OpenAI API key (platform.openai.com)

Setup

# 1. (recommended) create a virtual environment
python -m venv .venv
source .venv/bin/activate        # Windows: .venv\Scripts\activate

# 2. install dependencies
pip install -r requirements.txt

# 3. configure your API key
cp .env.example .env
# then edit .env and set OPENAI_API_KEY

Environment variables

See .env.example. The .env file is git-ignored.

Run

streamlit run app.py

Streamlit prints a local URL (typically http://localhost:8501). Open it, paste an unclassified report, and click Analyze. You can override the model and temperature from the sidebar per run.

Project layout

app.py             # Streamlit UI and rendering
analysis.py        # Prompt + OpenAI call (JSON contract), UI-independent
requirements.txt   # Dependencies
.env.example       # Copy to .env and fill in
.gitignore         # Keeps .env and caches out of git

Notes and limitations

• The ATT&CK mappings are tentative by design. Always read the per-tactic confidence and note; treat low-confidence items as prompts for discussion, not conclusions.

• Output quality tracks the input. Short or vague reports yield thinner analysis, and the model is instructed to say "Not stated in report" rather than fabricate details.

• The model can still make mistakes. Review the output before teaching from it.