Tools for consuming, aggregating, and analyzing external threat intelligence feeds from various sources.
cross-samuel1/soc-analyst-hubFree, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…
nict-csl/existEXIST is a web application for aggregating and analyzing cyber threat intelligence.
patrowl/patrowlhearsPatrowlHears - Vulnerability Intelligence Center / Exploits
olizimmermann/phishcollectorPhishCollector is a research framework for collecting, analysing, and tracking phishing sites.
renat0z3r0/notepadpp-supply-chain-iocsIoCs and detection rules for the Notepad++ supply chain attack (CVE-2025-15556) — Lotus Blossom APT, June–December 2025. Includes Falcon LogScale…
cspf-founder/darwis-taxiiA high-performance TAXII (Trusted Automated eXchange of Indicator Information) server written in Rust.
malvuln/sigint-hombreDynamically generated Suricata rules from real-time threat feeds
eclecticiq/opentaxiiTAXII server implementation in Python from EclecticIQ
aquasecurity/vuln-list-aquaSecurity advisories from Aqua Security
mfmokbel/crawlectorCrawlector is a threat hunting framework designed for scanning websites for malicious objects.
rollwagen/abusechCLI client for abuse.ch
sumidcyber/zeroscout🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…
xakepnz/enterpriseattackA lightweight Python module to interact with the [MITRE ATT&CK®](https://attack.mitre.org/) Enterprise dataset. Built for speed with minimal…
aquasecurity/vexhub-crawlerCollect VEX documents and update VEX Hub
qbitseclabs/brintelcollectorCyber Threat Intelligence (CTI) usando fontes e indicadores de ameaças nacionais, ou até globais, mas com evidencias ou indicadores nacionais do…
synacktiv/synacktiv-rulesPublic repository of Sigma and YARA rules created by Synacktiv
