agentic-threat-hunting-framework
nebulock-inc/agentic-threat-hunting-frameworkATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.
ai-securityeducationincident-response+7
394
nebulock-inc/agentic-threat-hunting-frameworkATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.
sumidcyber/zeroscout🦅 ZeroScout: The Autonomous Local & Cloud Threat Hunter. Visualize attacks in a live War Room, identify APT groups via Genetic Analysis, and…
tirrenotechnologies/tirrenoOpen-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks,…
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
jonrau1/syntheticsunServerless AWS security automation framework that ingests threat intelligence, applies ML-based anomaly detection (RCF, IP Insights), and enriches…
adversarial-detection-engineering/adversarial-detection-engineering-frameworkA framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concrete examples…
trappsec-dev/trappsecOpen-source framework for embedding realistic decoy routes and honey fields into APIs to detect attackers probing business logic, converting…
mahdi13830510/cve-2026-31431-mitigation-suiteKernel-runtime defense framework for AF_ALG vulnerabilities, featuring eBPF socket tracing, Ansible hardening, and a crypto auditor for drift…
opposum0112/cusimanseComposable research-contract and YAML-recipe framework for agent-operated security experiments on disposable compute
m-mizutani/alertresponderAutomatic security alert response framework by AWS Serverless Application Model
nerium-security/cve-2025-55182Host-based detection rules for the RCE vulnerability in the React JavaScript framework.
adrecon/adreconPowerShell tool that extracts Active Directory artifacts via LDAP or ADWS and generates Excel reports for auditing, DFIR, and penetration testing.
suprhackersteve/crescendoCrescendo is a swift based, real time event viewer for macOS. It utilizes Apple's Endpoint Security Framework.
hashicorp-forge/groveA Software as a Service (SaaS) log collection framework.
dereeqw/berrysentinelBerry Sentinel v5.0 — Advanced behavioral C2 and reverse shell detector for Linux/Windows/Unix systems. Features real-time connection analysis,…
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
danielbohannon/invoke-dosfuscationCmd.exe Command Obfuscation Generator & Detection Test Harness