Search

Open Cyber Threat Intelligence Platform

IntelOwl: manage your Threat Intelligence at scale

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

Open-source, enterprise-grade threat modeling platform

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

Raw data from Threat Intelligence Reports with automatic reports collection and keyword search across thousands of reports

威胁情报播报

An Investment Management toolkit for R. Because Excel is a threat to the global financial system.

Skynet — IPv4 firewall protection, threat feeds and traffic visibility for Asuswrt-Merlin. Manage your network through the WebUI or SSH.

Extract and aggregate threat intelligence.

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

MISP trainings, threat intel and information sharing training materials with source code

A query aggregator for OSINT based threat hunting

Threat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.

Zeek-Formatted Threat Intelligence Feeds

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Open-Source Vulnerability Intelligence Center - Unified source of vulnerability, exploit and threat Intelligence feeds

Sublime rules for email attack detection, prevention, and threat hunting.

Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.

iOS library (SDK) providing app security and threat monitoring. Shield your app with free RASP. Detect reverse engineering, jailbreak, Frida, emulators, bots, signature and integrity issues, VPN usage, and monitor device identification and more.

Threat model for Amazon S3 - Library of all the attack scenarios on Amazon S3, and how to mitigate them following a risk-based approach

Documenting your Threat Models with HCL

This repository contains a list of new remediation scripts.

Threat Intel Platform for T-POTs

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

Welcome to the Meta Threat Research Indicator Repository, a dedicated resource for the sharing of Indicators of Compromise (IOCs) and other threat indicators with the external research community

A simple threat modeling tool to help humans to reduce time-to-value when threat modeling

Data-Shield IPv4 Blocklist Community provides an official, curated registry of IPv4 addresses identified as malicious. Updated continuously, this resource offers vital threat intelligence to bolster your Firewall and WAF instances,...

A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts

An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.