--- title: OSINT Threat Analyst emoji: 🌐 colorFrom: indigo colorTo: blue sdk: gradio sdk_version: 5.23.0 app_file: app.py pinned: false license: apache-2.0 tags: - track:backyard - sponsor:modal - achievement:offgrid - achievement:welltuned - achievement:offbrand - achievement:llama - achievement:sharing - achievement:fieldnotes - osint - security - geopolitics - threat-intelligence - agentic - smolagents - conflict-analysis - travel-risk - nlp --- # 🌐 OSINT Threat Analyst An agentic multi-source open-source intelligence (OSINT) briefing tool that autonomously gathers, fuses, and synthesizes geopolitical conflict data into structured threat assessments — powered by a domain-specific fine-tuned model and real-time web search. --- # Links Dataset: https://huggingface.co/datasets/Firemedic15/Travel_Risk_Data Model: https://huggingface.co/Firemedic15/qwen25-1.5B-travel-risk-analysis-merged Youtube Demo: https://youtu.be/7wUZ_K2XoxI Social Media (x.com): https://x.com/Phreakaz0id/status/2066264751789736093 Blog Post: https://huggingface.co/blog/Firemedic15/osint-agent GGUF Version (Ollama downloadable): https://huggingface.co/Firemedic15/Qwen2.5_Risk_1.5B (Quantized version available) --- --- # Team: - Firemedic15 --- ## What It Does Select a country or region, choose your news sources, and click **Run Analysis**. The agent fans out across live data sources, synthesizes the picture, and returns a structured threat brief covering: - Severity rating and confidence level - Recent armed conflict events (ACLED) - Real-time news headlines (Tavily + RSS) - State Department travel advisory level - Airspace restrictions - Embassy and consulate contacts for your passport country A raw agent trace tab exposes every tool call and model step for full auditability. --- ## Architecture This Space demonstrates a **context-aware agentic analyst** loop backed by a fine-tuned domain model: ``` User Query │ ▼ smolagents ToolCallingAgent │ ├── fetch_acled_events → Structured conflict event data (ACLED API) ├── fetch_rss_headlines → Open-source reporting (30+ RSS feeds) ├── tavily_search → Real-time web search (Tavily API) ├── fetch_travel_advisory → State Dept advisory level + notes ├── fetch_airspace_status → NOTAM / airspace restriction data └── list_available_sources → Source inventory │ ▼ Modal REST Endpoint (Firemedic15/qwen25-1.5B-travel-risk-analysis-merged) │ ▼ Structured Threat Brief (HTML + PDF export) ``` The inference backend is a **Qwen2.5-1.5B model fine-tuned on domain-specific travel risk data**, hosted on Modal with an A10G GPU. The Space itself is CPU-only — all model weight stays off HuggingFace compute. Tavily provides real-time web search results that fill the gap between ACLED's structured event data and RSS headline coverage, capturing breaking developments and primary-source reporting that feeds don't yet index. --- ## Data Sources | Source | Type | Coverage | Access | |--------|------|----------|--------| | [ACLED](https://acleddata.com) | Structured conflict events | 80+ countries | Free API key | | [Tavily](https://tavily.com) | Real-time web search | Global | Free tier available | | BBC, Al Jazeera, Reuters | RSS news | Global | Open | | Bellingcat, Crisis Group, War on the Rocks | OSINT / analysis | Conflict-specific | Open | | UN News, Human Rights Watch, Amnesty | Policy / humanitarian | Global | Open | | Middle East Eye, AllAfrica, Radio Free Asia | Regional reporting | Regional | Open | | State Department | Travel advisories | All countries | Open | | AVWX / AviationWeather | Airspace / NOTAMs | Global | Free token | 30+ RSS sources are available in the source selector. Select any combination per query. --- ## Model Inference is handled by **[Firemedic15/qwen25-1.5B-travel-risk-analysis-merged](https://huggingface.co/Firemedic15/qwen25-1.5B-travel-risk-analysis-merged)** — a Qwen2.5-1.5B-Instruct model fine-tuned on the [Firemedic15/Travel_Risk_Data](https://huggingface.co/datasets/Firemedic15/Travel_Risk_Data) dataset covering country-level risk assessments, conflict event summaries, advisory reasoning, and structured threat brief generation. The model is served via a [Modal](https://modal.com) REST endpoint (A10G GPU, serverless, scales to zero). GGUF quantized versions for local use are available at [Firemedic15/Qwen2.5_Risk_1.5B](https://huggingface.co/Firemedic15/Qwen2.5_Risk_1.5B). --- ## Setup (Self-Hosting) Set the following Space secrets under **Settings → Variables and Secrets**: ### Required | Secret | Description | Where to get it | |--------|-------------|-----------------| | `MODAL_ENDPOINT` | Your Modal inference URL | Printed after `modal deploy serve.py` | | `MODAL_API_TOKEN` | Bearer token protecting your Modal endpoint | Set via `modal secret create api-token` | | `ACLED_USERNAME` | ACLED API username | [developer.acleddata.com](https://developer.acleddata.com) | | `ACLED_EMAIL` | Email registered with ACLED | Same registration | | `TAVILY_API_KEY` | Tavily search API key | [tavily.com](https://tavily.com) — free tier available | | `HF_TOKEN` | HuggingFace token | Auto-injected in Spaces | ### Optional | Secret | Description | Where to get it | |--------|-------------|-----------------| | `AVWX_TOKEN` | Enables NOTAM / airspace lookups | [avwx.rest](https://avwx.rest) — free | (Not currently in use) --- ## Research Context This tool operationalizes the **context-aware agentic security analyst architecture** explored in ongoing research on converged physical/cyber security intelligence operations. The agentic loop pattern — autonomous tool selection, multi-source ingestion, real-time search augmentation, and structured synthesis — mirrors the design described in supporting academic work targeting *Computers & Security* and *Journal of Cybersecurity*. Key contributions demonstrated here: - **Domain fine-tuning at small scale** — A 1.5B parameter model, fine-tuned on structured risk data, handles threat synthesis without relying on frontier model API access - **Real-time augmentation** — Tavily search grounds the model in current events beyond its training cutoff - **Multi-source fusion** — Structured (ACLED), unstructured (RSS), and live (Tavily) data are co-analyzed in a single agent loop - **Transparent reasoning trace** — Every tool call and model step is logged for analyst oversight and auditability - **Serverless GPU inference** — Modal backend scales to zero cost when idle; no always-on GPU expense --- ``` ``` ``` ``` ### Swap the inference backend The `ModalModel` class in `app.py` is a thin wrapper around a POST endpoint. To swap backends, change `MODAL_ENDPOINT` to any endpoint that accepts `{"prompt": "...", "max_new_tokens": N}` and returns `{"response": "..."}`. --- ## Stack | Component | Role | |-----------|------| | [smolagents](https://github.com/huggingface/smolagents) | HuggingFace-native agentic framework | | [Firemedic15/qwen25-1.5B-travel-risk-analysis-merged](https://huggingface.co/Firemedic15/qwen25-1.5B-travel-risk-analysis-merged) | Domain fine-tuned inference model | | [Modal](https://modal.com) | Serverless GPU hosting for model inference | | [Tavily](https://tavily.com) | Real-time web search API | | [ACLED API](https://acleddata.com) | Structured armed conflict event data | | [Gradio 5](https://gradio.app) | UI framework | | [AVWX](https://avwx.rest) | Airspace and NOTAM data (optional) | --- ## Related Resources | Resource | Link | |----------|------| | Fine-tuned model | [Firemedic15/qwen25-1.5B-travel-risk-analysis-merged](https://huggingface.co/Firemedic15/qwen25-1.5B-travel-risk-analysis-merged) | | GGUF (local inference) | [Firemedic15/Qwen2.5_Risk_1.5B](https://huggingface.co/Firemedic15/Qwen2.5_Risk_1.5B) | | Training dataset | [Firemedic15/Travel_Risk_Data](https://huggingface.co/datasets/Firemedic15/Travel_Risk_Data) | | GitHub | [de0015](https://github.com/de0015) | --- ## Disclaimer ⚠️ AI-generated from open sources. Not for operational use without independent verification. ACLED data is third-party and subject to their [terms of use](https://acleddata.com/terms-of-use/). Tavily results reflect public web content at time of query. Threat assessments produced by this tool are a starting point for analyst review, not a finished intelligence product.