During an incident response engagement I kept switching between browser tabs: AbuseIPDB, VirusTotal, Shodan, internal logs. Every pivot took time I didn't have. So I built a unified dashboard that does the enrichment automatically.
The problem
When you're triaging a potential breach, every second counts. The typical DFIR analyst workflow looks like this: extract an IOC from a log, paste it into a browser, wait, screenshot, and repeat fifty times. It's slow, error-prone, and it pulls you out of the analysis mindset.
The solution
The DFIR Intel Dashboard accepts a list of IPs, domains or hashes and concurrently queries multiple threat intelligence APIs. Results are correlated and scored automatically, with critical indicators surfaced at the top.
# Install
git clone https://github.com/jlok94/dfir-intel-dashboard
cd dfir-intel-dashboard
pip install -r requirements.txt
# Configure your API keys
cp .env.example .env
# Run
python app.pyArchitecture
The dashboard is a single-file Python Flask app backed by a SQLite cache, so you're not hammering APIs on every page load. The frontend is plain HTML, CSS and JavaScript with no build step.
The goal was a tool that works out of the box in an air-gapped environment, with local LLM support via LM Studio and no external AI dependencies.
Local LLM integration
One of the features I'm most proud of is the local LLM integration. You can run a Llama or Mistral model via LM Studio on the same machine, and the dashboard will summarise threat actor profiles and suggest remediation steps.
What's next
I'm working on MISP integration for enterprise deployments and a Shodan search module. Contributions are welcome on GitHub.