<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Precursor | Pre-Protocol Similarity Triage</title>
<meta name="description"
content="Precursor turns raw packets, logs, and binary blobs into labels, similarity clusters, and analyst-ready triage output." />
<link rel="preconnect" href="https://fonts.googleapis.com" />
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
<link
href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;600&display=swap"
rel="stylesheet" />
<link rel="icon" type="image/svg+xml" href="favicon.svg" />
<link rel="stylesheet" href="styles.css" />
<script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token": "e26f679adf2e457baf5617c0fd4b466a"}'></script>
</head>
<body>
<div class="ambient" aria-hidden="true"></div>
<header class="topbar">
<a class="brand" href="#top" aria-label="Precursor home">
<img src="precursor-mark.svg" alt="Precursor logo" width="44" height="44" />
<span>
<strong>Precursor</strong>
<small>pre-protocol payload triage</small>
</span>
</a>
<nav>
<a href="#scenarios">Scenarios</a>
<a href="#analyst-loop">Analyst Loop</a>
<a href="#llm-loop">LLM Demo</a>
<a href="#install">Install</a>
</nav>
</header>
<main id="top">
<section class="hero">
<div class="hero-copy">
<p class="eyebrow">precursor.hashdb.io</p>
<h1>Find structure in raw payloads before protocol parsers exist.</h1>
<p>
Precursor tags, clusters, and prioritizes packet, log, and firmware payloads with one JSON-first CLI.
It is built for early-stage triage where you need signal now, not after parser engineering.
</p>
<div class="hero-actions">
<a class="button primary" href="#install">Install Precursor</a>
<a class="button" href="https://github.com/Obsecurus/precursor" target="_blank" rel="noreferrer">GitHub</a>
<a class="button" href="#scenarios">Explore Demos</a>
</div>
<div class="hero-metrics" id="hero-metrics"></div>
</div>
<aside class="hero-terminal" aria-label="Precursor output teaser">
<div class="terminal-head">
<span>Signal Teaser</span>
<button type="button" id="cycle-teaser">Next</button>
</div>
<pre><code id="teaser-code"></code></pre>
</aside>
</section>
<section class="positioning" aria-labelledby="positioning-title">
<div class="section-head">
<h2 id="positioning-title">Why Teams Use It</h2>
<p>
Precursor is the bridge between "we have weird bytes" and "we can confidently scope response or build deeper detection."
</p>
</div>
<div class="position-grid">
<article>
<h3>Security Ops</h3>
<p>
Collapse noisy probe traffic into families and rank suspicious payload clusters before writing full parser logic.
</p>
</article>
<article>
<h3>DFIR + Firmware</h3>
<p>
Tag binary fragments and filesystem magic quickly so analysts can prioritize which artifacts deserve deeper reverse engineering.
</p>
</article>
<article>
<h3>Detection Engineering</h3>
<p>
Start with Sigma/PCRE labeling, then use similarity + stats to refine into stable, explainable signal.
</p>
</article>
</div>
</section>
<section class="flow" aria-labelledby="flow-title">
<div class="section-head">
<h2 id="flow-title">Workflow at a Glance</h2>
</div>
<ol class="flow-steps">
<li>
<strong>Ingest</strong>
<span>String, base64, hex, or raw binary blobs from stdin or folders.</span>
</li>
<li>
<strong>Label</strong>
<span>Named PCRE captures (or Sigma selectors) become portable tags.</span>
</li>
<li>
<strong>Cluster</strong>
<span>TLSH, LZJD, FBHash (optional MRSHv2 adapter) group near-neighbor payloads.</span>
</li>
<li>
<strong>Refine</strong>
<span>`--stats` and protocol hints feed analyst/LLM refinement loops.</span>
</li>
</ol>
</section>
<section id="scenarios" class="scenarios" aria-labelledby="scenario-title-heading">
<div class="section-head">
<h2 id="scenario-title-heading">Interactive Scenario Explorer</h2>
<p>
Click a scenario to inspect command, real output, and run stats captured from public sample corpora.
</p>
</div>
<div class="scenario-layout">
<aside id="scenario-list" class="scenario-list" aria-label="Scenario list"></aside>
<article class="scenario-view">
<h3 id="scenario-name"></h3>
<p id="scenario-description"></p>
<div id="scenario-meta" class="meta"></div>
<div id="scenario-tabs" class="tabs" role="tablist" aria-label="Scenario output tabs"></div>
<div class="terminal">
<div class="terminal-head">
<span id="scenario-panel-label"></span>
<button id="copy-command" type="button">Copy Command</button>
</div>
<pre><code id="scenario-panel"></code></pre>
</div>
<p id="scenario-links" class="data-links"></p>
</article>
</div>
</section>
<section id="analyst-loop" class="loop" aria-labelledby="loop-title-heading">
<div class="section-head">
<h2 id="loop-title-heading">Analyst Refinement Loop</h2>
<p>
This visual shows how adding targeted tags changes measurable signal across iterations, not just intuition.
</p>
</div>
<div class="loop-layout">
<div id="loop-steps" class="loop-steps" aria-label="Loop steps"></div>
<article class="loop-detail">
<h3 id="loop-step-title"></h3>
<p id="loop-step-summary"></p>
<div id="loop-bars" class="loop-bars" aria-label="Loop metric bars"></div>
<div class="terminal compact">
<div class="terminal-head">
<span>Step Stats JSON (excerpt)</span>
</div>
<pre><code id="loop-json"></code></pre>
</div>
</article>
</div>
</section>
<section id="llm-loop" class="llm" aria-labelledby="llm-title">
<div class="section-head">
<h2 id="llm-title">LLM-Guided Discovery Demo</h2>
<p>
Local Codex CLI consumed Precursor stats + sample NDJSON, proposed a new pattern, then we validated the command on the same corpus.
</p>
</div>
<div class="llm-grid">
<article class="llm-card">
<h3>Codex Suggestion</h3>
<p id="llm-why"></p>
<ul id="llm-refinements"></ul>
<div class="terminal compact">
<div class="terminal-head">
<span>Suggested Pattern</span>
</div>
<pre><code id="llm-pattern"></code></pre>
</div>
<div class="terminal compact">
<div class="terminal-head">
<span>Suggested Command</span>
</div>
<pre><code id="llm-command"></code></pre>
</div>
</article>
<article class="llm-card">
<h3>Measured Outcome</h3>
<div id="llm-deltas" class="delta-grid"></div>
<p class="risk"><strong>Risk:</strong> <span id="llm-risk"></span></p>
<div class="terminal compact">
<div class="terminal-head">
<span>Runtime Note</span>
</div>
<pre><code id="llm-runtime"></code></pre>
</div>
</article>
</div>
</section>
<section class="stats-guide" aria-labelledby="stats-guide-title">
<div class="section-head">
<h2 id="stats-guide-title">How to Read <code>--stats</code></h2>
</div>
<div class="position-grid">
<article>
<h3>Input</h3>
<p>
Track payload volume and size distribution so performance regressions or capture shifts are obvious.
</p>
</article>
<article>
<h3>Match</h3>
<p>
See which tags dominate and whether new patterns add precision or just noise.
</p>
</article>
<article>
<h3>Compare + Environment</h3>
<p>
Validate similarity mode, distance behavior, and runtime context when sharing findings or benchmarking.
</p>
</article>
</div>
</section>
<section id="install" class="install" aria-labelledby="install-title">
<div class="section-head">
<h2 id="install-title">Install and Run in Under 60 Seconds</h2>
</div>
<div class="terminal">
<div class="terminal-head">
<span>Quick Start</span>
<button id="copy-install" type="button">Copy</button>
</div>
<pre><code id="install-command">cargo install precursor
cat samples/scenarios/pre-protocol-packet-triage/payloads.b64 \
| precursor -p samples/scenarios/pre-protocol-packet-triage/patterns.pcre \
-m base64 -t -d --similarity-mode lzjd -P --protocol-hints --stats</code></pre>
</div>
<div class="hero-actions">
<a class="button primary" href="https://github.com/Obsecurus/precursor" target="_blank" rel="noreferrer">Download on GitHub</a>
<a class="button" href="https://crates.io/crates/precursor" target="_blank" rel="noreferrer">Crates.io</a>
</div>
<p class="sources">
Background inspiration and historical context:
<a href="https://www.greynoise.io/blog/precursor-a-quantum-leap-in-arbitrary-payload-similarity-analysis" target="_blank" rel="noreferrer">blog post 1</a>
and
<a href="https://www.labs.greynoise.io/grimoire/2023-10-11-precursor/" target="_blank" rel="noreferrer">blog post 2</a>.
</p>
</section>
</main>
<footer>
<p>Precursor is open source and built for practical payload triage workflows.</p>
</footer>
<script src="app.js"></script>
</body>
</html>
