Kyberis is the intelligence layer. It sits between your feeds and your agents, scoring intelligence so every call returns a provenance-grounded answer. Add Kyberis skills to your agents, and they’re threat-enabled.
Kyberis takes in Commercial, OSINT, Curated, and any private feeds of your own, and rationalizes them into one consistent schema. Duplicates collapse, conflicts resolve, and your agent reads one format instead of each feed’s own.
Kyberis resolves each indicator to the actor behind it, then to that actor’s full history: prior campaigns, infrastructure reuse, tooling changes. Every query you run deepens the graph.
Your agent calls Kyberis over MCP or REST and gets confidence-scored, structured context with full provenance. No glue code.
Your agent reaches confident decisions in 1–3 queries, with lower LLM cost, fewer false positives, and an auditable chain of evidence on every action, so you can show why it decided what it did.
Once your agent has Kyberis skills, these are the direct questions it can ask:
Which signals deserve attention first, for this environment?
Why was one signal ranked above another?
What changed since the last run?
Is this IOC known, suspicious, or unsupported by current evidence?
Does this CVE require immediate action for your stack?
Which related entities should be investigated next?
Each answer arrives with its own confidence score and source chain, so your agent can show why, not just what.
A single tool call returns graph context your agent can reason over, not flat JSON it has to guess at.
# Agent calls Kyberis over MCP tool: kyberis.investigate args: { "indicator": "185.220.101.42" } # Response: confidence-scored graph context { "indicator": "185.220.101.42", "verdict": "malicious", "confidence": 0.94, "linked_actor": "APT-29 (cluster)", "campaigns": ["COZY-2025-Q4"], "proof_points": 17, "provenance": ["DCSO", "Talos", "ISAC-FS"], "recommended_action": "block + hunt lateral" }
Illustrative example: values shown are representative, not live data.
The graph is built on DCSO’s threat intelligence. Use it as-is, layer in your own feeds, or both. Kyberis runs alongside your existing stack. No rip-and-replace required.
Swap out your noisy, flat, single-source feeds for one confidence-scored knowledge graph. Your agents get cleaner signal with fewer queries and lower cost.
Bring Your Own Feed (BYOF). Kyberis layers graph context, confidence scores, and provenance onto the intelligence you already run, a better foundation for your stack.
Add Kyberis skills, threat-enable your agent, and start asking threat questions right away.
