forge
Forge
The pipeline behind the site: scripts, timing, and the local artifacts that power Daily → Incidents → MITRE.
Pipeline map (MVP)
- Security Pulse generator writes the Daily brief artifacts.Trigger: nightly scheduled job (local) · Output:
output/daily_pulse/YYYY-MM-DD/ - CVE KB + triage backfill enriches CVE→technique mappings for CVEs mentioned in Daily.Trigger: daily precompute job · Output:
output/cve_kb/current/triage_enriched.json - MITRE links index builds Technique → Daily/Incident lookup.Trigger: daily precompute job · Output:
output/mitre_links/daily_index.json - Voice prep + narration (optional) builds reusable voices and caches audio outputs.Trigger: manual or scheduled runs (as needed) · Outputs:
output/voiceprep/,output/tts_cache/ - Next.js site reads the artifacts and renders pages.
Key artifacts (what the site reads)
Daily brief (JSON)
output/daily_pulse/YYYY-MM-DD/daily_brief.v1.jsonCVE triage (enriched)
output/cve_kb/current/triage_enriched.jsonUsed by: MITRE chips on /daily/[date]
MITRE knowledge base (SQLite)
output/mitre_kb/enterprise/current/index.sqliteUsed by: /mitre, technique pages
Technique links index
output/mitre_links/daily_index.jsonUsed by: /mitre/[technique]
Voice prep + cloning artifacts
output/voiceprep/Used by: Narration tooling (voice profiles) · supports cached audio workflows
TTS cache
output/tts_cache/Used by: Generate-once audio caching (avoid per-request synthesis)
Timing & triggers (current)
- Security Pulse refresh: scheduled local run (currently 7pm PT).
- Precompute indices: daily 7:15am PT.Runs triage backfill + rebuilds the technique→daily/incident index.
- Voice prep / cloning: on-demand (when adding/updating a voice).Produces reusable voice assets and feeds cached narration workflows.
Tool catalog (MVP)
Security Pulse generator
Script:
daily_debrief/scripts/run_security_pulse.py- Inputs: RSS/news sources + local config
- Outputs:
output/daily_pulse/YYYY-MM-DD/daily_brief.v1.json,daily_brief.md,run.json - Trigger: scheduled (local) + manual
- Failure modes: upstream source fetch errors; empty day; schema drift
CVE triage scorer
Script:
cve_kb/triage.py- Inputs:
output/cve_kb/current/index.sqlite,threat_relevance.json,output/cpe_join/... - Outputs:
output/cve_kb/current/triage.json(+triage.md) - Trigger: manual / scheduled as desired
- Failure modes: missing upstream KB artifacts; overly strict matching (too few items)
Daily CVE → technique backfill
Script:
cve_kb/triage_enrich_from_daily.py- Inputs: Daily briefs (
output/daily_pulse/*/daily_brief.v1.json) + CVE KB - Outputs:
output/cve_kb/current/triage_enriched.json - Trigger: daily precompute job
- Failure modes: CVE missing from CVE KB; threat_relevance missing; empty daily_pulse
MITRE technique index (knowledge base)
Artifact:
output/mitre_kb/enterprise/current/index.sqlite- Inputs: MITRE CTI data (built upstream into SQLite)
- Used by: /mitre and technique detail pages
- Failure modes: missing DB; very large queries (keep results bounded)
MITRE links index builder
Module:
site/src/lib/mitreLinks.ts (writes JSON index)- Inputs: daily briefs + triage_enriched + incidents seed
- Outputs:
output/mitre_links/daily_index.json - Trigger: daily precompute job
- Failure modes: stale cache if inputs newer; missing triage_enriched (falls back)
Voice prep + cached narration
Artifacts:
output/voiceprep/, output/tts_cache/- Goal: generate once, reuse forever (avoid per-request synthesis)
- Trigger: on-demand (when adding/updating a voice or regenerating audio)
- Failure modes: missing voice assets; API/provider failures; cache invalidation
Dashboard status
Script:
dashboard/status.py- Outputs: dashboard status artifact(s) under
output/ - Trigger: scheduled health check
- Failure modes: upstream artifacts missing; partial pipeline failures (yellow/red)
What’s next
- Daily archive filtering by technique (e.g.,
?technique=T1190) - Technique → Incident/CVE/Daily deep links (more precise, section-aware anchors)
- Upgrade tool catalog: add exact commands + expected runtimes + recovery playbooks