#1Tools for consuming, aggregating, and analyzing external threat intelligence feeds from various sources.
Kitploit recommended
vulncheck-oss/jupyter-notebooksExample Jupyter notebooks that query VulnCheck APIs to chart exploitation timelines, Known Exploited Vulnerabilities, and botnet data for threat…
rootless-ghost/vulnforgeVulnerability & exploit intelligence — ExploitDB, NVD, Metasploit search with CVE→ATT&CK mapping and LogNorm/HuntForge integration | Part of Nebula…
aquasecurity/secfixes-trackerForked from https://gitlab.alpinelinux.org/kaniini/secfixes-tracker
teycir/seekyouOSINT intelligence on any IP, domain, or ASN
hurricanelabs/machinaeAutomated security intelligence collector that queries public feeds and APIs for threat data on IPs, domains, URLs, hashes, and SSL fingerprints,…
hslatman/awesome-threat-intelligenceCurated directory of threat intelligence sources, feeds, frameworks, tools, and research for SOC/CTI teams—covering IOCs, STIX/TAXII formats, and…
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
blevene/bandjacksCyber Threat Defense World Modeling
emergingthreats/threatresearchProofpoint - Emerging Threats - Threat Research tools + publicly shared intel and documentation
certtools/intelmqIntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
pirxthepilot/wtfisPassive hostname, domain and IP lookup tool for non-robots
montysecurity/c2-trackerLive Feed of C2 servers, tools, and botnets
adham504/sentinelthread-forensicsHigh-speed Windows forensic triage platform that orchestrates the Hayabusa engine to transform raw EVTX logs into prioritized threat timelines with…
inquest/threatkbKnowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL) (ALPHA STATE AT THE MOMENT)
kaal22/darkgrid3D threat intelligence dashboard that visualizes malicious infrastructure from OSINT sources like AbuseIPDB and OpenPhish, with a live threat feed,…
cross-samuel1/soc-analyst-hubFree, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…
nict-csl/existEXIST is a web application for aggregating and analyzing cyber threat intelligence.
olizimmermann/phishcollectorPhishCollector is a research framework for collecting, analysing, and tracking phishing sites.
