Lists (3)
Starred repositories
TAXII server implementation in Python from EclecticIQ
Automated handling of data feeds for security teams
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
Microsoft Threat Intelligence Security Tools
Built for the frontlines of cyber defense, our next-generation MISP empowers edge deployments and threat hunters with fast, lightweight, and actionable intelligence, anytime, anywhere.
Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regex…
Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, collaborate with the communit…
Easy-to-use live forensics toolbox for Linux endpoints
A Linux version of the Procmon Sysinternals tool
Zeek Analysis Tools (ZAT): Processing and analysis of Zeek network data with Pandas, scikit-learn, Kafka and Spark
A standard for reducing log volume without sacrificing analytical capability
Tenzir is the data pipeline engine for security teams.
The FLARE team's open-source tool to identify capabilities in executable files.
Zui is a powerful desktop application for exploring and working with data. The official front-end to the Zed lake.
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
All of the ad-hoc things you're doing to manage incidents today, done for you, and much more!
An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.
Virtual Machine for Adversary Emulation and Threat Hunting
Automate the creation of a lab environment complete with security tooling and logging best practices
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.