Intel Workbench
Structured Analytic Techniques for CTI
Structured analytic techniques for the browser
Overview
Intel Workbench brings structured analytic techniques from the intelligence community into the browser. It implements the Analysis of Competing Hypotheses (ACH) methodology developed by Richards Heuer at the CIA, alongside cognitive bias checklists, IOC extraction, and the Diamond Model of Intrusion Analysis.
Everything runs client-side with localStorage persistence. No backend, no accounts, no data leaving the analyst's machine. Load the page, start analyzing. The Sandworm APT sample project ships pre-loaded so analysts can see the workflow before building their own matrices.
Analysis Tools
Interactive Analysis of Competing Hypotheses with weighted scoring. Rate evidence against hypotheses as Consistent, Inconsistent, or Neutral, with credibility and relevance multipliers.
12 cognitive, analytical, and social biases with progress tracking and mitigation notes. Forces analysts to confront their own reasoning blind spots.
Paste raw threat reports and extract IPs, domains, URLs, hashes, emails, and CVEs via regex. Deduplicate, defang/refang, and export as CSV or JSON.
Visual intrusion event modeling with four vertices (adversary, capability, infrastructure, victim), kill chain phase mapping, and confidence scoring.
ACH Scoring Model
Each cell in the ACH matrix represents an analyst's judgment about how a piece of evidence relates to a hypothesis. The scoring formula weights these ratings by evidence credibility and relevance to produce a composite score per hypothesis. Higher scores indicate more inconsistency, so the hypothesis with the lowest score is the preferred explanation.