


TCP/IP packet demultiplexer. Download from:

Curated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.

Containerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…

This repository provides a centralized resource for operational cyber defense and offense, compiling Theory, Tools, Operating Procedures, and…

AIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project

Free hands-on digital forensics labs for students and faculty

Capture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…

DFIR forensics companion server + capture extension

Repository created to share information about tactics, techniques and procedures used by threat actors. Initially with ransomware groups and evolving…

Archive of the Top 10 Web Hacking Techniques - every nominee since 2006, preserved

A comprehensive collection of penetration testing cheatsheets, guides, and tools.

SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

Know what changed inside your Electron release: diff two builds for IPC, preload, windows, fuses and hosts, with file:line. CLI, CI gate, MCP server.

Search Windows forensic artifacts, see where each one lives on disk, and copy the KAPE command to collect it. Also builds collection scripts and…

Self-hosted multi-engine Sigma detection for event logs

Visibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.