theory

THEORY is an open-source tool designed to produce comprehensive threat actor intelligence dossiers by aggregating data from various cybersecurity sources, including MITRE ATT&CK and AlienVault OTX. It leverages a large language model to synthesize information into easily digestible executive summaries and detailed intelligence reports, which feature TTP tables, detection opportunities, and enriched IoCs. Key functionalities include the generation of IR playbooks and export options in multiple formats, making it suitable for threat intelligence analysts, detection engineers, and security researchers.