100_days_of_kql_2026
m4nbat/100_days_of_kql_2026A repo to hold KQL queries as part of my 100 days of KQL effort.
threat-feeds-aggregatorsthreat-intelligenceeducation+3
19
Tools for consuming, aggregating, and analyzing external threat intelligence feeds from various sources.
m4nbat/100_days_of_kql_2026A repo to hold KQL queries as part of my 100 days of KQL effort.
cspf-founder/darwis-taxiiA high-performance TAXII (Trusted Automated eXchange of Indicator Information) server written in Rust.
blevene/bandjacksCyber Threat Defense World Modeling
stanfrbd/cyberbroA simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
toborrm9/malicious_extension_sentryMalicious Extension Database
adham504/sentinelthread-forensicsHigh-speed Windows forensic triage platform that orchestrates the Hayabusa engine to transform raw EVTX logs into prioritized threat timelines with…
certtools/intelmqIntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
cross-samuel1/soc-analyst-hubFree, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…
olizimmermann/phishcollectorPhishCollector is a research framework for collecting, analysing, and tracking phishing sites.
opencti-platform/openctiOpen Cyber Threat Intelligence Platform
fastfire/deepdarkctiCollection of Cyber Threat Intelligence sources from the deep and dark web
misp/mispMISP (core software) - Open Source Threat Intelligence and Sharing Platform
intelowlproject/intelowlScalable threat intelligence platform that enriches observables and files using 200+ analyzers, with built-in GUI, REST API, and automated workflows…
neo23x0/signature-baseYARA signature and IOC database for my scanners and tools
hurricanelabs/machinaeAutomated security intelligence collector that queries public feeds and APIs for threat data on IPs, domains, URLs, hashes, and SSL fingerprints,…
shirkdog/pulledporkPulled Pork for Snort and Suricata rule management (from Google code)