Sri Lanka's
Cyber Defense
Network.
A unified national platform where citizens, security analysts, and organizations collaborate to detect, report, and respond to cyber threats in real time.
More than a
dashboard.
Legion CTI is Sri Lanka's central hub for cyber threat intelligence. Citizens report incidents, professional analysts verify and publish intelligence, and organizations receive sector-specific briefings — all in one secure platform.
Built for every
defender.
Every feature is designed to make cyber defense accessible, effective, and collaborative — from a first-time reporter to a seasoned analyst.
Professional analysts review all community reports before publishing, keeping the intelligence feed accurate and actionable at all times.
SOC teams and security managers receive curated, sector-specific threat briefings to protect their workforce and infrastructure.
Anyone can securely report suspicious activity — phishing, scams, or malware — directly contributing to the national defense effort.
Encrypted communication channels between analysts, citizens, and organizations for confidential coordination and incident response.
Visualize attack trends, monitor sector exposure, and track threat evolution through interactive dashboards and historical data.
Role-based access control with OTP email verification ensures only verified individuals can access sensitive intelligence at each tier.
Choose your
role.
Legion CTI serves three distinct groups, each with a dedicated portal and purpose-built tools.
Report cyber incidents, read public threat advisories, and contribute to national cybersecurity awareness and community defense.
Sign inPublish verified threat intelligence, map adversary TTPs to MITRE ATT&CK, and collaborate with the professional security community.
Sign inManage your security team, receive sector-specific briefings, and submit incidents directly to the national intelligence database.
Sign inFrom report to
resolution.
Citizens and organizations submit suspicious activity through their secure portal — phishing emails, malware, or social engineering attacks.
Certified analysts review each submission, correlate with existing intelligence, and validate severity using MITRE ATT&CK mapping.
Verified intelligence is published to the national feed — tagged by sector, severity, and attack vector for fast, accurate triage.
Organizations act on briefings to harden their defenses, while citizens receive clear advisories to stay safe online.
Help secure
Sri Lanka.
Whether you're a citizen, a security professional, or running an organization — your contribution strengthens national defense.