assafkip/theia

Theia is a tool for security analysts who need to pull threat indicators out of a threat intelligence report. You paste in a link to a PDF or web page, and it extracts every IP address, domain, URL, file hash, CVE number, email address, named threat actor, malware name, and vendor detection rule that is literally written in the document, each one shown alongside the exact sentence that proves it is there. The key idea is that Theia does not use an AI model to do the actual extraction, so it cannot make up an indicator that was never in the report. Instead it uses a fixed set of rules built from pattern matching, so the same report always produces the same result. It also understands common ways attackers try to hide indicators in text, such as writing hxxps colon slash slash evil dot com instead of a real clickable link, and converts these back to their normal form. Named threats, like actors, tools, and malware, are matched against a built in reference list based on MITRE ATT&CK and Malpedia, and a match only means the name appears in the text, not that Theia is making any claim about who is responsible. Any detection rules the report includes, like Sigma, YARA, or Snort rules, are pulled out exactly as written and clearly labeled as coming from the report rather than from Theia itself. Everything can be exported to a CSV file, and there is an optional AI powered pass that can flag likely noise, such as the vendor's own domain name, without ever adding or removing an actual indicator. Theia is explicitly not a security monitoring system, a scanner, or a tool that produces ready to deploy detections. It only states what the report contains, not what it means or whether something is dangerous. It runs as a web app built with Next.js, with no database and no user accounts required, and it is free to use with no signup at the project's live site. The optional noise flagging feature needs an Anthropic API key to work.