Why GNAT exists
Most security teams are forced to keep rebuilding the same automation, enrichment, and reporting logic around slightly different APIs and data models. GNAT exists to reduce that churn by standardizing the integration surface and keeping intelligence workflows portable.
What GNAT does
Normalize
Unify many data sources behind one operating model.
Translate
Use STIX 2.1 as the stable contract between tools and workflows.
Support analysis
Build investigations, reports, and reusable workflows rather than isolated lookups.
Anchor the ecosystem
Provide the hub platform that SandGNAT, SenseGNAT, & RedGNAT plug into.
Documentation by intent
GNAT uses the Diátaxis model so readers can go directly to the kind of material they need.
| Action (doing) | Study (reading) | |
|---|---|---|
| Learning | Tutorials Guided, newcomer-safe walkthroughs. |
Explanation Architecture, rationale, and design choices. |
| Working | How-to guides Task-focused procedures and recipes. |
Reference Exact technical behavior, config, and interfaces. |
Quick visual overview: View the 38-slide presentation deck for an interactive technical deep-dive on architecture, features, and deployment.
Start here by role
Analysts
Use GNAT when you need to correlate intelligence across multiple systems and keep the output portable.
Investigators
Use GNAT when you need a repeatable path from seed indicators to evidence and report output.
Engineers
Use GNAT when integration churn is the real bottleneck.
The GNAT-o-sphere
SandGNAT
Automated malware sandbox analysis — detonate binaries in isolated VMs, capture behavioral artifacts, emit STIX 2.1 objects.
Learn moreRedGNAT
Continuous automated readiness testing — ingest threat intel, construct adversary emulation scenarios, execute with safety controls.
Learn moreSenseGNAT
Network profiling and behavior analysis that surfaces anomalies and enriches GNAT investigations with traffic-layer context using network sensor and honeypot telemetry — high-volume ingestion from Kafka topics, Redis dedup, automatic campaign linking.
Learn moreGNAT-gui
Browser-based analyst workbench — manage investigations, review evidence graphs, run gap analysis, draft reports, and monitor jobs with live streaming progress.
Learn more