#1IR playbooks, triage, case management, evidence collection, and incident management tools.
Kitploit recommended
cyb3rxp/awesome-socA curated knowledge base to build, run and mature a SOC (including CSIRT).
kunai-project/kunaieBPF-based Linux security monitor and threat hunter providing chronologically ordered, container-aware events with on-host correlation for incident…
stanfrbd/cyberbroA simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
rankthree/soc-detection-t1003.001-cve-2021-40444SOC detection rules and content for T1003.001 LSASS credential dumping and CVE-2021-40444 exploitation activity.
cloud-gouv/securixSécurixOS is a NixOS-based secure operating system tailored for small to medium-sized teams. It provides a minimal, hardened environment with strong…
abrignoni/aleappAndroid Logs Events And Protobuf Parser
furkankayapinar/cve-2026-94127Read-only defensive detector for CVE-2026-94127 in F5 BIG-IP APM. Fingerprints hosts, checks versions via iControl REST, and verifies OAuth…
shuffle/shuffleOpen-source security orchestration, automation, and response (SOAR) platform with a visual workflow editor, prebuilt security app integrations, and…
mohamedbrek/soc335-cve-2024-49138-exploitation-detectedLetsDefend SOC lab investigating CVE-2024-49138 and related malicious activity.
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
node9-ai/node9-proxyIAM for your AI agents. Set what Claude Code, Codex, Gemini, Cursor and any MCP server are allowed to do, review risky actions before they run, and…
misp/misp-objectsCurated JSON object templates that define MISP attributes and relationship types for structured threat intelligence sharing and interoperable IOC…
duggytuxy/data-shield_ipv4_blocklistCurated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…
griisemine/cve-2026-87902-detectionDetection toolkit and reproducible lab for CVE-2026-87902, an unauthenticated WordPress path traversal. Includes remote checker, IoC analyzer, Sigma…
honeylabshq/spip-goSpip network sensor written in Go
wadesweaponshed/cve-2026-93616_checksShell and SmartDashboard scripts that check Check Point management servers for indicators of compromise tied to CVE-2026-93616, including rogue…
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
microsoft/msticpyMicrosoft Threat Intelligence Security Tools
