Joinable Security · Threat Map
From threat report to ATT&CK map in two minutes.
Threat Map processes government advisories and threat research, mapping the behaviors they describe to MITRE ATT&CK, and showing the exact sentence behind every mapping. Adversary intelligence for defenders.
12
Reports mapped
200
Unique ATT&CK techniques
14/14
Kill-chain tactics covered
29%
Of the ATT&CK catalogue
Watch the demo
A real run on an APT28 advisory: 31 techniques mapped across 10 of 14 tactics.
The problem
Indicators expire. Behaviour doesn’t.
Threat intelligence arrives as prose across dozens of pages, with adversary behaviors described inconsistently and scattered throughout.
Slow
Manual mapping means reading every report end to end and recalling technique IDs from memory.
Inconsistent
Different analysts produce different maps from the identical report.
Unsafe to shortcut
General language models invent plausible but false technique IDs.
What it does
An ATT&CK map you can actually defend.
Validated, not guessed
Every technique is checked against all 679 MITRE techniques. Invented IDs are rejected and shown.
Traceable to the page
Each mapping carries the supporting phrase and the source page it came from.
Finds what is new
Diffs each report against MITRE’s documented group profiles to surface new behavior.
Detections, drafted
Generates Sigma-style detection rule sketches from the mapped behavior.
Compare adversaries
Put actors side by side to see how their techniques overlap and differ.
Your documents stay yours
Private collections, with no operator visibility into what you upload.
How it works
Upload, map, export.
Upload
PDF, Office, CSV, TXT, or Markdown, up to 75 MB.
Map
Ten targeted retrieval queries sweep the kill chain. Every extracted technique is validated against the full 679-technique catalogue; invented IDs are rejected and shown.
Export
Open results in ATT&CK Navigator, or export as CSV or a STIX 2.1 bundle. About two minutes per report.
Why ten queries instead of one
A single “find all the techniques” prompt has poor recall over a long document, it finds the obvious behaviours and stops. Ten targeted questions each own a band of the kill chain, so retrieval is pulled toward every stage. If a band comes back empty, it re-probes before giving up.
Why validation is separate from extraction
The language model proposes; the ATT&CK catalogue disposes. Six rules run over every technique, ID format, catalogue membership, valid tactic, canonical name, confidence range, grounding evidence. The pass rate is reported and rejected rows are shown, not hidden.
Proof
Real government advisories, already mapped.
Eight of the twelve reports in the public demo library come from CISA, the FBI, the NSA, Australia’s ACSC, the UK NCSC, and partner agencies. Every technique traces to a real source page.
Kimsuky (Velvet Chollima)
G0094North Korea · AA20-301A
26
techniques
30%
of 71
3
novel
APT28 (Fancy Bear)
G0007Russia · AA20-336A
25
techniques
25%
of 71
4
novel
Turla (Snake)
G0010Russia · AA23-129A
22
techniques
20%
of 50
10
novel
Leviathan (APT40)
G0065China · AA24-190A
21
techniques
30%
of 37
9
novel
Lazarus Group
G0032North Korea · AA22-108A
19
techniques
21%
of 67
2
novel
APT41 (Wicked Panda)
G0096China · FBI Wanted
16
techniques
18%
of 66
4
novel
Sandworm Team (APT44)
G0034Russia · AA22-054A
16
techniques
17%
of 64
5
novel
Volt Typhoon
G1017China · AA24-038A
16
techniques
25%
of 57
1
novel
Who it’s for
Built for the people who defend.
CTI analysts
Clear the reading backlog. Map a report in two minutes instead of an afternoon, with evidence attached for the write-up.
Detection engineers
Go from advisory to draft rules without a translation meeting. The output names the log sources to watch.
Threat hunters
Start from the techniques a specific actor actually uses against your sector, not a generic list.
SOC managers and leadership
Overlay several adversaries in ATT&CK Navigator to see which techniques recur, and where the coverage gaps sit.
A new joint advisory drops — map it before the morning briefing.
Compare two actors targeting your sector, and build detections covering both.
Turn a year of collected reporting into one Navigator layer.
Justify a detection-engineering roadmap with evidence from named adversaries.
Spot the genuinely new tradecraft in an advisory about a group you already track.
Hand a junior analyst a worked example built on real government advisories.
Trust and privacy
Your reports stay yours.
Your documents stay in your own account
On first sign-in a collection is created under your Joinable account. Uploads go there. No other user, and no operator of the instance, can read them.
Standard OAuth 2.0 / OpenID Connect
Authorization Code flow with PKCE (S256). ID tokens verified against the published keys with RS256 pinned. No password is ever handled by the application.
OAuth tokens are not retained
Sign-in provisions a dedicated API key, then the access and refresh tokens are revoked immediately. The key is encrypted at rest with AES-256-GCM, never sent to the browser, never rendered, never logged.
Isolation at the data layer
Records are owner-scoped in the database, so every read is filtered by owner regardless of which route asks. Private analyses are visible only to their owner.
The public demo makes no API calls
Browsing the twelve mapped reports is entirely static, it touches no external service at all.
From community to governed knowledge
Bring what you learn into your own governed knowledge.
Threat Map is the top-of-funnel companion to Runbooks. What you learn about adversary behavior can flow into your own governed knowledge through Propagator, curated before any agent acts on it, never blindly from the open internet.