Tools for consuming, aggregating, and analyzing external threat intelligence feeds from various sources.
paloaltonetworks/unit42-timely-threat-intelA collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.
t-beckett/vulnbookStatic vulnerability findings tracker with parallel search across 11 CVE databases, EPSS enrichment, CISA KEV badges, coordinated disclosure…
misp/mispMISP (core software) - Open Source Threat Intelligence and Sharing Platform
ransomlook/ransomlookAutomated ransomware and leak-site OSINT tracker scraping dark-web markets, monitoring victim posts, enriching actor/crypto data, and sending…
threatlabz/iocsCurated Indicators of Compromise and YARA rules from Zscaler ThreatLabz public reports for threat hunting, malware research, and detection…
stanfrbd/cyberbroA simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
wiz-sec-public/wiz-research-iocs
m4nbat/100_days_of_kql_2026A repo to hold KQL queries as part of my 100 days of KQL effort.
katrielmoses/voidaccessSelf-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and…
the_quantum_alpha/the-quantum-ad-listAI-curated blocklist of 3,000,000+ domains for blocking ads, trackers, malware, and cryptojacking. Integrates with hosts files, Pi-hole, and browser…
expel-io/expel-intelThis is the home of the Expel Intel Team. Here, we will share IOCs and other information that is either not suitable for fitting into other mediums…
neo23x0/signature-baseYARA signature and IOC database for my scanners and tools
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
bushidouk/ransomware-tool-matrixA resource containing all the tools each ransomware gangs uses
pduggusa/dugganusa-ietfDugganUSA threat-intelligence contributions to the IETF Hackathon — real-world agentic-attack benchmark vectors, CVE-2026-33697 attestation analysis,…
essexrich/threatactors-ttpsRepository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.
