Theia
Pull the IOCs out of a threat intel report.
Paste a link, a PDF or a web page. Theia extracts every IOC, named threat, and the vendor's own detection rules, each tied to the exact line it came from. It runs on fixed rules, not a model, so the same report always gives the same output. Anything it can't find in the text, it drops.
45.61.134.36ip · the line that proves it“…establishes a reverse SSH tunnel from the victim machine to the actor's C2 server with the IP address 45[.]61[.]134[.]36 and the port 443 instead of the default SSH port.”verbatim from the Cisco Talos Chaos ransomware reportSee it run
Did it make anything up?
No. Every indicator is a verbatim string from the document, shown with the exact line that proves it. If a value is not literally in the text, byte for byte, it is dropped, not shown. Nothing is inferred, scored, or invented.
How much of it is noise?
An optional pass flags the indicators that look like the vendor's own domain, a reference link, or example.com, so you are not scrubbing them by hand. It only suggests. It never adds or removes anything on its own.
What does it miss?
It is a mechanical extractor, not a complete reader. Split or line-wrapped indicators, exotic defangs, internal hostnames, values inside screenshots, and names absent from the snapshot are missed by design. The source span is shown on every item so its blind spots are visible, not hidden.
Can you defend it in a review?
Yes. It runs on fixed rules, regex and curated matching, with no model in the loop. The same report gives the same output every time, and every indicator traces to a line. Reproducible and auditable, not a black box.
Can you get it into your tooling?
One click exports every finding to CSV: category, type, indicator, defanged form, count, and the source span. STIX and MISP export are on the roadmap.
Provenance, not maliciousness. Theia asserts what a report contains, never what it means, whether it is malicious, or how to detect it. The Sigma sweeps it templates are hunt starting points, not deployable detections.
Drops what it can't prove
A fact ships only if it matches the source byte-for-byte. Ungrounded claims are dropped, not shown.
Not a detection tool
Not a SIEM, not a deployable-detection generator. Sweep snippets are hunt starting points, never shipped rules.
The fact layer
Interpretation changes company to company. That is the full KTLYST product. This is the free front door.