Menu

BRIEFR · open source · the first Project Jupiter module

Answers, not another raw feed.

Self-hosted CVE intelligence for analysts. BRIEFR syncs NVD, CISA KEV, EPSS, MITRE, OTX and RSS into your own PostgreSQL, then turns them into a morning brief you can act on.

Read the sourceTry the live demoDocumentation

A morning in BRIEFR, scene by scene

  1. What broke overnight.

    BRIEFR opens on a digest of what actually needs attention, not a raw NVD dump.

    Morning brief · hero stats · what-changed deltas · 90-day heatmap

    Screenshot: Briefr morning brief action queue with reason chips, hero stats, and 90-day heatmap

  2. Exploited, and patchable.

    Beside the severity counts: what CISA KEV lists as exploited in the wild, and what already has a patch.

    Hero stats · CISA KEV · patches available

  3. A queue with reasons attached.

    Every item says why it is there: KEV due soon, an EPSS mover, a new KEV entry, or a match on your stack.

    Reason chips · rule-based scoring, reproducible with zero AI keys

  4. Ask the feed in plain terms.

    Type “amazon + poc” and the feed reads it as a vendor and a public proof-of-concept.

    Stack filter · vendor chips · KEV, EPSS and PoC filters · CSV and XLSX export

    Screenshot: Briefr full CVE feed with stack filter, vendor chips, KEV sidebar, and export toolbar

  5. One CVE. One decision.

    Operational priority comes with its reasons. Here: listed in CISA KEV, with a public PoC.

    Overview · Intel · Detect · Related, without leaving the feed

    Screenshot: Briefr CVE detail drawer with Intel tab, correlation, and detection context

  6. A PoC is not exploitation.

    Signals stay separate. KEV, public PoC, momentum and CVSS each say something different.

    Key exploitation signals · KEV remediation due dates

  7. Check an indicator. Keep your quota.

    IPs, hashes and domains against the sources you hold keys for, with each quota in view.

    VirusTotal · AbuseIPDB · GreyNoise · OTX · MalwareBazaar · URLhaus

    Screenshot: Briefr IOC lookup enriching IP, hash, and domain indicators

  8. Pivot through what you already stored.

    CVE, IOC, technique, campaign and publication hops, expanded from your own database.

    Stored-intel graph · no live enrichment on each click

    Screenshot: Briefr INVESTIGATE graph browser over stored CVE, IOC, technique, and publication hops

  9. The story behind the CVE.

    Headlines, structured CISA advisories and MITRE ATLAS case studies, cross-linked to CVEs.

    Served from scheduler-built snapshots

    Screenshot: Briefr Advisories and Intel feed with headlines, structured advisories, and MITRE ATLAS case studies

  10. From technique to hunt pack.

    See where ATT&CK techniques in your feed have community rules, saved packs, or gaps.

    Sigma rules · Elastic, Splunk, Sentinel and QRadar snippets

    Screenshot: Briefr Forge MITRE ATT&CK coverage map and hunt pack generation

  11. Is the data current? It says so.

    Per-source feed health, so you know when to trust the brief and when to wait.

    Intel status · source health · alert channels

    Screenshot: Briefr admin analyst view with intel status, source health, and alert channels

  12. One box you can run yourself.

    Scheduler jobs, backups, database integrity and API keys, on hardware you own.

    2 cores · 4 GB RAM recommended · 2 GB without the embedding model

    Screenshot: Briefr admin operator view with API keys, scheduler jobs, and security posture

Skip the reel

A morning in BRIEFR, screen by screen

Briefr morning brief action queue with reason chips, hero stats, and 90-day heatmap
BRIEFWhat broke overnight. BRIEFR opens on a digest of what actually needs attention, not a raw NVD dump.Exploited, and patchable. Beside the severity counts: what CISA KEV lists as exploited in the wild, and what already has a patch.A queue with reasons attached. Every item says why it is there: KEV due soon, an EPSS mover, a new KEV entry, or a match on your stack.
Briefr full CVE feed with stack filter, vendor chips, KEV sidebar, and export toolbar
FEEDAsk the feed in plain terms. Type “amazon + poc” and the feed reads it as a vendor and a public proof-of-concept.
Briefr CVE detail drawer with Intel tab, correlation, and detection context
CVE DETAILOne CVE. One decision. Operational priority comes with its reasons. Here: listed in CISA KEV, with a public PoC.A PoC is not exploitation. Signals stay separate. KEV, public PoC, momentum and CVSS each say something different.
Briefr IOC lookup enriching IP, hash, and domain indicators
IOC LOOKUPCheck an indicator. Keep your quota. IPs, hashes and domains against the sources you hold keys for, with each quota in view.
Briefr INVESTIGATE graph browser over stored CVE, IOC, technique, and publication hops
INVESTIGATEPivot through what you already stored. CVE, IOC, technique, campaign and publication hops, expanded from your own database.
Briefr Advisories and Intel feed with headlines, structured advisories, and MITRE ATLAS case studies
ADVISORIES & INTELThe story behind the CVE. Headlines, structured CISA advisories and MITRE ATLAS case studies, cross-linked to CVEs.
Briefr Forge MITRE ATT&CK coverage map and hunt pack generation
FORGEFrom technique to hunt pack. See where ATT&CK techniques in your feed have community rules, saved packs, or gaps.
Briefr admin analyst view with intel status, source health, and alert channels
ADMIN · ANALYSTIs the data current? It says so. Per-source feed health, so you know when to trust the brief and when to wait.
Briefr admin operator view with API keys, scheduler jobs, and security posture
ADMIN · OPERATOROne box you can run yourself. Scheduler jobs, backups, database integrity and API keys, on hardware you own.

02 How data reaches you

Nothing is fetched on page load.

YOUR SERVER · TRUST BOUNDARYSYNCED ON A SCHEDULECALLED ON DEMANDOPEN A CVE · CACHEDLOOK UP AN IOC · YOUR KEYSOPTIONAL LLM · CAPPEDALERTS OUTNVDcvelistV5CISA KEVVulnrichmentEPSSMITRE ATT&CKMITRE ATLASOTXThreatFoxSigmaHQRSS × 501Ingestscheduled jobslocal embeddings02StorePostgres + pgvectorYou · browsernginx · login03WorkFastAPI + ReactSploitusOSV.devCIRCLOTXVirusTotalAbuseIPDBGreyNoiseMalwareBazaarURLhausYour LLMencrypted backupsDiscordTelegramHTTPS05Operateadmin + alertsYOUR SERVERSYNCED ON A SCHEDULEON DEMANDNVDcvelistV5CISA KEVVulnrichmentEPSSMITRE ATT&CKMITRE ATLASOTXThreatFoxSigmaHQRSS × 501Ingestscheduled jobslocal embeddings02StorePostgres + pgvectorbrowser · login03WorkFastAPI + ReactSploitusOSV.devCIRCLOTXVirusTotalAbuseIPDBGreyNoiseMalwareBazaarURLhausYour LLMencrypted backupsDiscordTelegramHTTPS05Operateadmin + alerts

Schedulers pull upstream intel into your PostgreSQL, and pages read what is already stored. Anything else goes out only when you open a CVE or run a lookup.

  1. scheduled jobs

    Ingest

    APScheduler jobs sync NVD, cvelistV5, CISA KEV, Vulnrichment, EPSS, MITRE ATT&CK and ATLAS, OTX and five RSS feeds, plus ThreatFox and a SigmaHQ mirror when enabled. Every source is paced, retried and circuit-broken.

  2. Postgres + pgvector

    Store

    PostgreSQL 16 holds CVE rows, feed mirrors, caches and correlation precomputed nightly. With embeddings on, a small model on your own CPU writes vectors to a pgvector index for semantic search.

  3. FastAPI + React

    Work

    You sign in through nginx to BRIEFR’s built-in login. The brief, feed, search and Forge are served from what is already stored, behind rate limits and an audit log.

  4. on demand, cached

    Ask

    Opening a CVE adds Sploitus, OSV.dev, CIRCL and OTX context, cached. IOC lookups check a 6-hour cache before using your keys, and never retry a quota-billed call. Any LLM is optional and capped.

  5. admin + alerts

    Operate

    Admin shows feed health, scheduler and durable jobs, API quotas, logs and the audit trail. Webhooks alert Discord, Telegram or any HTTPS endpoint; backups are age-encrypted, with a dead-man check.

03 Scope and limits

Honest by design.

What BRIEFR is, and deliberately is not. Each line is a chosen constraint with a reason, stated plainly.

  1. One instance, one shared login.

    Out of scope Multi-tenant or a cloud service

    Your hardware, your data. A team can share the one login; separate accounts are not built yet. When they come, API quotas stay pooled per instance, since every call leaves one server IP and stacking free keys there breaks the terms of AbuseIPDB, VirusTotal and others.

  2. Deterministic, LLM-free core.

    Out of scope Scores decided by an LLM

    Correlation, scoring and scheduling are reproducible with zero AI keys. LLMs only narrate and extract at the edges, always with template fallbacks.

  3. Freshness is upstream plus your scheduler.

    Out of scope Real-time

    Data is as current as the public feeds and your cadence. Every intel section shows its as-of line. BRIEFR never pretends to be real-time.

  4. Prioritization, not discovery.

    Out of scope A scanner, ASM tool or pentest platform

    It explains and ranks known-CVE intel against your stack. It is not a scanner, ASM tool or pentest platform.

  5. Community-source intelligence.

    Out of scope Vendor-grade attribution

    Correlation derives from OTX community pulses. One community source is not vendor-grade attribution, and the product labels it that way in-line.

  6. Community detection rules.

    Out of scope A claim of coverage

    Detect prefers a local SigmaHQ index. An empty section means no CVE-tagged rule, not a claim of coverage. Generated Sigma is a hunt starter only.

  7. Term-based stack matching.

    Out of scope SBOM precision

    Fuzzy by design: vendor and product strings, not SBOM precision. Every match is labelled with the term that matched, so you can judge it.

  8. One box, small hardware.

    Out of scope Redis or microservices

    2 cores and 4 GB RAM recommended, which covers the local embedding model behind semantic search. Without it, 2 GB runs fine. PostgreSQL, one process family, no Redis, no microservices.

The trade these constraints buy: trust, reproducibility, and a system a small team can actually operate and fully understand.

BRIEFR · PRODUCT.md

04 Where it stands

Run it yourself.

BRIEFR is ready to self-host from source today. What is missing is the packaging, not the product.

  • Source codeOpen on GitHub under Apache-2.0Ready
  • Local deploymentPostgreSQL 16 + pgvector, app built from sourceReady
  • Production installdeploy/briefr-install.sh on Debian with nginxReady
  • DatabasePostgreSQL 16 + pgvector, compose file includedReady
  • Live demoSame analyst shell over fixture dataReady
  • Packaged deliveryDocker image and one-command stack are not shipped yetNot yet

Needs Python 3.11+ · Node.js 22.22+ · Git · Docker only for the bundled Postgres

Hardware 2 cores · 4 GB RAM recommended (2 GB without the embedding model)

Self-host guideWhat has shipped
Local Deployment
docker pull pgvector/pgvector:pg16docker run -d --name briefr-postgres -e POSTGRES_USER=briefr -e POSTGRES_PASSWORD=briefr -e POSTGRES_DB=briefr -p 127.0.0.1:5432:5432 pgvector/pgvector:pg16# Those are the defaults. Change the user or password in that command if you need to.# Database URL: postgresql://briefr:briefr@127.0.0.1:5432/briefrgit clone https://github.com/Soldier0x0/briefr.git && cd briefrcd backend && python3 -m venv .venv && source .venv/bin/activatepip install -r requirements-dev.txtcp .env.example .env# Leave .env.example where it is. In backend/.env the fields are already there.# Put your database URL in DATABASE_URL.# Set the other fields to the correct values, including BRIEFR_REQUIRE_POSTGRES, BRIEFR_ENV, and JWT_SECRET.cd ../frontend && npm install && npm run buildcd ../backend && source .venv/bin/activate && uvicorn main:app --host 0.0.0.0 --port 8000# Docker image of BRIEFR# Coming soon

05 The larger picture

BRIEFR is the part that shipped.

Project Jupiter is a modular, self-hosted security platform, built one plane at a time in the order the work depends on. No dates, just the sequence.

  1. NowIntel plane — BRIEFRCVE intelligence, IOC enrichment, MITRE context, detection packs and investigation.Open source
  2. NextData plane — Log ingestionParsers for logs from different sources, then normalization and storage.Planned
  3. ThenOperations plane — Hunt and governHunting across the collected data, and governance over it.Planned

Every plane stays linked to BRIEFR, so its intelligence can drive enrichment and automation across the platform.

06 Attribution

Project Jupiter

TLP:CLEARDisclosure is not limited.

Built and maintained by

Sai Harsha Vardhan

Security engineer · threat hunter · platform builder

My background is threat hunting, SIEM operations and data pipelines. I build Project Jupiter so small teams can run analyst-grade intel themselves, and BRIEFR is the first module to ship.

Coverage

  • Threat research
  • Detection engineering
  • Data pipelines
  • Backend and API
  • Interface and design
  • Operations and self-hosting

One maintainer, every layer.

Field experience

Data Integration Specialist
Allure Commerce LLPData ingestion and transformation pipelines
Cyber Threat Hunter
AtosHunting across SIEM logs and threat intelligence
Production Support Engineer (L3)
AtosSIEM middleware application support
Network & Security Instructor
Mythri Ojas Training InstituteFoundational cybersecurity

Credentials

  • EC-CouncilCEHCertified Ethical Hacker
  • EC-CouncilCHFIComputer Hacking Forensic Investigator
  • AtosBronzeBronze Accolade, Q1 2024
Education
MBA, Information Technology ManagementB.Sc, Computer Science & Electronics
Provenance
Every screen in the reel is captured from a running, self-hosted BRIEFR.
Intelligence sources
NVD · cvelistV5 · CISA KEV · Vulnrichment · EPSS · MITRE ATT&CK · MITRE ATLAS · OTX · ThreatFox · SigmaHQ · RSS × 5
Stack
FastAPI · PostgreSQL 16 + pgvector · React 19

Contact and disclosure

Found a vulnerability in BRIEFR? Report it privately by email, not in a public issue. The security policy covers coordinated disclosure.

BRIEFR

Open source today. Self-hosted by design.

Read the sourceTry the live demoDocumentation

Next: the data plane.Parsers for logs from different sources, then normalization and storage. Planned.