A real-time cyber threat intelligence dashboard in your terminal.
CYBRWIRE pulls the latest alerts from hundreds of top security sources (CISA KEV, The Hacker News, Krebs, BleepingComputer, ZDI, Kaspersky, VulDB, and many more), classifies them by severity, and displays them in a continuously updating, color-rich TUI built with Textual and Rich.
CYBRWIRE also includes tools (via api keys) to identify malicious IPs and query databases for malicous file hashes.
More than just a glorified feed-reader, CYBRWIRE is designed for security analysts, red teamers, blue teamers, and anyone who wants to keep an eye on the threat landscape without leaving the terminal.
- 300+ curated threat intelligence sources including CISA, NSA, FBI, SANS, Microsoft, Cisco, Kaspersky, and more
- Multi-format feed support – JSON, RSS, and plain text feeds
- Configurable feeds – define curated, custom, and community intelligence sources via YAML
- Real-time threat enrichment – Integrate with VirusTotal, AbuseIPDB, Pulsedive, and Abuse.ch APIs
- AI-powered threat analysis – War Room mode with Google Gemini for executive summaries
- Color-coded severity tagging (Critical/KEV, Zero-Day, Ransomware, APT, Exploit)
- Real-time metrics dashboard with threat heat level, alert rates, top sources, and incident correlation
- Live scrolling ticker displaying latest threats and alerts
- Multiple theme support – cycle through GNOME Dark, Green/Black High Contrast, Solarized Dark, and more
- Cold War Mode – authentic green-on-black terminal aesthetic for when you're feeling like it's 1985
- Customizable recency window (24h / 48h / 7 days)
- Advanced filtering – view alerts only, incidents, or API enrichment tools
- Interactive browsing – open threat sources in your default browser
- Incident correlation – automatically group related threats by CVE, IP, hash, and domain
- Manual refresh with keyboard controls and feed pagination
- Minimal dependencies – runs with
rich,httpx,feedparser,pyyaml,textual, andgoogle-genai
# Clone the repo
git clone https://github.com/QIO1984/cybrwire.git
cd cybrwire
# Recommended: create a virtual environment
python3 -m venv venv
source venv/bin/activate
# Install dependencies
pip install -r requirements.txt
# Configure API keys (optional, for enrichment features)
cp usrwire.yaml cybrwire_local.yaml
# Edit cybrwire_local.yaml and add your API keys
# Run it!
python3 cybrwire.py| Key | Action |
|---|---|
h |
Show help screen |
r |
Force refresh all feeds |
d |
Cycle data age (24h → 48h → 7d) |
f |
Cycle filter (all → alerts only → posts only) |
4 |
Cycle threat feed source (all → curated → custom → community) |
tab |
Switch between main feed and dashboard panels |
v |
Cycle main view (alerts → incidents → API tools) |
c |
Toggle Cold War Mode |
t |
Cycle theme |
g |
Refresh AI threat analysis (War Room) |
e |
Re-enable disabled feeds |
q |
Quit |
CybrWire supports optional threat intelligence API enrichment. Configure API keys in cybrwire_local.yaml:
enrichment:
gemini_api_key: "your-gemini-api-key-here"
virustotal_api_key: "your-vt-api-key-here"
abuseipdb_api_key: "your-abuseipdb-api-key-here"
pulsedive_api_key: "your-pulsedive-api-key-here"
abuse_ch_api_key: "your-abuse-ch-api-key-here"Note: API keys in cybrwire_local.yaml are in .gitignore and will never be committed to GitHub.
Use file usrwire.yaml as template to create cybrwire_local.yaml, or rename it.
CybrWire supports multiple threat intelligence providers with optional API key enrichment. Free and limited API tiers have restrictions on indicator types they can query.
- Free Tier: IP addresses only
- Hash/domain/URL lookups not supported on free tier
- Rate limit: 4 queries/minute, 500/day quota
- Paid Tier: Full access to IPs, hashes, domains, URLs
- When to upgrade: If you need comprehensive hash and domain enrichment
- Free Tier: IP reputation lookups only
- Limited to IP addresses (no hashes, domains, URLs)
- Paid Tier: Enhanced features and higher rate limits
- When to upgrade: For broader query quotas and advanced scoring
- Free Tier: Limited indicator database
- May not have comprehensive hash or malware data
- Paid Tier: Full threat intelligence database access
- When to upgrade: For comprehensive threat data across all indicator types
- Free/Open: Full access to hash and URL databases
- No API key required (public database)
- Best option for free hash and malicious URL lookups
- Recommended for: Hash and URL enrichment on free tier (no upgrade needed)
For best results with CybrWire enrichment:
- Use Abuse.ch (free, no key needed) for hash and URL enrichment
- Use AbuseIPDB for IP reputation (free tier available)
- Upgrade VirusTotal if you frequently check hashes and domains
- Configure multiple providers for redundancy and broader coverage
cybrwire.yaml– Curated official threat feeds (CISA, NSA, Microsoft, etc.)usrwire.yaml– Additional community and third-party feedscomwire.yaml– Custom community-contributed feeds - Submit yours via PRcybrwire_local.yaml– LOCAL TESTING ONLY (your private API keys, in .gitignore)
Press g to refresh AI-powered threat analysis powered by Google Gemini. Get executive summaries of current threat landscape with top CVEs, threat actors, and industry targeting patterns.
CybrWire automatically correlates related alerts across different feeds by:
- CVE identifiers
- IP addresses and geographic hotspots
- File hashes (malware families)
- Domain names
- Attack patterns and threat actors
View incidents in the Incidents panel for a unified threat picture.
Query threat intelligence APIs directly from CybrWire:
- Enter an indicator (IP, hash, domain, or URL)
- Get reputation scores and threat details from all configured providers
- See which APIs support which indicator types
- Python 3.8+
rich– Beautiful terminal outputhttpx– Async HTTP client for feed fetchingfeedparser– RSS/Atom feed parsingpyyaml– YAML configuration filestextual– TUI frameworkgoogle-genai– Optional, for War Room AI analysis
MIT License - See LICENSE file for details
Contributions are welcome and much needed! Please feel free to submit pull requests or open issues for bugs and feature requests.
If you have a cool source for intel, please submit it via PR to the comwire.yaml Verified feeds will be added to the canon.
By: GitHub/QIO1984 // The Hacker known as MADNOTE
Stay vigilant. Stay informed. Stay WIREed