DEV Community
Follow
I pushed the badBANANA Threat Observatory public
The project originated from a long-standing desire to create a threat visualization tool that prioritized evidence over impressive presentation. Many existing threat maps are visually engaging but often lack analytical depth, serving different purposes like marketing or education. The author aimed to build something that maintained a sense of observation and movement, but where the underlying data rigorously justified the interface's display. This led to the creation of the badBANANA Threat Observatory, which monitors sources like CISA KEV and ThreatFox. Crucially, the focus was on robust evidence handling rather than just the dashboard itself. The author meticulously audited the system to prevent overstating what it knew, addressing issues like missing data becoming zeroes or invalid indicators being reclassified. This involved stricter validation for IOCs and hashes, safer exports, and careful deployment gates. The current version maintains a clear distinction between what a source reports, what changed, what was retained, and what was rejected. It ensures that bounded APIs look bounded, failed sources appear failed, and missing confidence remains missing. The Observatory is not intended to replace analysts or imply a live global cyberwar but rather to facilitate the inspection of evidence without silently filling in gaps. The public release underwent multiple audit and remediation passes to ensure its integrity.