tiberscope

TLPT scoping helper — DORA Art. 24 / TIBER-EU four-phase plan + suite-tool map

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install tiberscope

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- tiberscope

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

tiberscope --help                # subcommand catalogue + flags
tiberscope --full                # extended help across every subcommand
tiberscope --about               # machine-readable attribution (JSON)
tiberscope --version             # version string

What it does

tiberscope scopes a Threat-Led Penetration Test under DORA Art. 24 and the TIBER-EU framework (batch-2 RTS), ties the scope into the existing offensive stack (pentree, payloadforge, mailforge, wifiaudit, vlanrecon, phishprobe, urlrecon, credsweep, avwatch, openclaw, darkrecon, socq, specter), and emits the artefact as a jfind/v1 brief for dossier to render. Phase 4 of the cli.johlem.net consulting layer (jfind → complymap → dossier → inciclass → roigen → tiberscope). Four subcommands: scope (walks the five TIBER-EU applicability questions, partitions the function inventory into in-scope critical functions vs out-of-scope, recommends one of TLPT / Reduced / Standard); plan (produces the canonical TIBER-EU four-phase timeline — Preparation 4w / Threat Intelligence 4w / Red-Team 12w / Closure 4w — with per-phase start/end dates derived from --start); map (cross-references the eight bundled attack paths AP-001..AP-008 against every in-scope function, each pinned to a real suite tool AND a real pentree methodology node such as web_app/auth or windows_ad/phishing-execution — so the scoping artefact reads "we will execute AP-003 with phishprobe + payloadforge, tracked under pentree node windows_ad/phishing-execution"); brief (emits a jfind/v1 finding with category=tlpt-scope, severity High when TLPT is recommended, pre-filled DORA Art. 24 + Art. 26 controls). Vendored methodology at data/tiber_methodology.json (5 questions, 4 phases, 5 tier-1 actor families, 8 attack paths). Offline-only — no network, no Anthropic API, no SaaS. 10 unit + 10 integration tests green; zero compiler warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Compliance crosswalk

This table lists controls where tiberscope's output may form part of the evidence set presented to an assessor. It does not claim tiberscope alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/tiberscope/compliance.json

DORA — Digital Operational Resilience Act (Reg. 2022/2554)

RefNameHowCoverage
Art. 24 Advanced testing (TLPT) scope subcommand answers the 5 applicability questions per Art. 24; plan subcommand emits a compliant 4-phase methodology + timeline. evidences
Art. 25 Testing requirements plan tracks Prep 4w / TI 4w / RT 12w / Closure 4w minimums. evidences
Art. 26 Requirements for testers brief subcommand includes tester-qualification requirements section. partial

TIBER-EU — TIBER-EU framework (ECB)

RefNameHowCoverage
Prep phase Preparation phase (~4 weeks) Baked into plan output. evidences
TI phase Threat intelligence phase (~4 weeks) Baked into plan output. evidences
RT phase Red team phase (~12 weeks) Baked into plan output; map subcommand references pentree nodes + sibling suite tools. evidences
Closure phase Closure phase (~4 weeks) Baked into plan output. evidences

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.