#1Tools for consuming, aggregating, and analyzing external threat intelligence feeds from various sources.
Kitploit recommended
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
arpsyndicate/vedas-signaturesVEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for over 14,000 CVEs
yeti-platform/yetiYour Everyday Threat Intelligence
jivoi/awesome-osint😱 A curated list of amazingly awesome OSINT
functori/argos/argosAnalysis and Representation of Graphs of Suspicious Operations (Analyse et Représentation des Graphes des Opérations Suspectes)
facebook/threatexchangeTrust & Safety tools for working together to fight digital harms.
paloaltonetworks/unit42-timely-threat-intelA collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.
cisagov/kev-dataMirrors CISA's Known Exploited Vulnerabilities (KEV) catalog as CSV and JSON with a JSON schema, enabling programmatic access and commit-history…
toborrm9/malicious_extension_sentryMalicious Extension Database
misp/misp-objectsCurated JSON object templates that define MISP attributes and relationship types for structured threat intelligence sharing and interoperable IOC…
crowdsecurity/crowdsecOpen-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
katrielmoses/voidaccessSelf-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and…
fastfire/deepdarkctiCollection of Cyber Threat Intelligence sources from the deep and dark web
ransomlook/ransomlookYet another Ransomware gang tracker
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
reloading01/certstream-server-rustHigh-performance Certificate Transparency (CT) monitoring tool written in Rust. Real-time stream of newly issued SSL/TLS certificates from CT logs.…
