gnomeman/badbanana-threat-observatoryThreat intel observatory aggregating CISA KEV, ThreatFox, URLhaus, and MalwareBazaar feeds with search, change tracking, and STIX/CSV/JSONL export.
log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
mitre-attack/attack-stix-dataSTIX 2.1 collections of the MITRE ATT&CK knowledge base, providing adversary tactics and techniques for enterprise, mobile, and ICS threat…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
mvt-project/mvtForensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…
misp/misp-galaxyClusters and elements to attach to MISP events or attributes (like threat actors)
facebook/threatexchangeTrust & Safety tools for working together to fight digital harms.
misp/misp-objectsCurated JSON object templates that define MISP attributes and relationship types for structured threat intelligence sharing and interoperable IOC…
shuffle/shuffleOpen-source security orchestration, automation, and response (SOAR) platform with a visual workflow editor, prebuilt security app integrations, and…
securityronin/memory-forensicWalk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
nomi-sec/nvd-database📕NVD Database
laugiov/scambusterDefensive engagement & threat intelligence research laboratory. Converts inbound scam emails into actionable IOCs through controlled, policy-driven…
0x0allenace/windows-malware-behavioral-analysisBehavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC…
eh-amish/windows-defender-security-auditor-cve-2026-50656-Read-only PowerShell security auditor for Windows endpoints and servers: checks Defender configuration, patch status, credentials, persistence,…
soldier0x0/briefrOpen Vulnerability Intelligence platform, aggregated intel in one dashboard, with correlation and IOC lookups, completely self hosted. All resources…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
wiz-sec-public/wiz-research-iocsCurated public database of indicators of compromise aggregated by Wiz Research for threat detection, hunting, and incident response workflows.
executemalware/malware-iocsCurated collection of indicators of compromise extracted from real-world malware investigations, including hashes, domains, and IPs for threat…
