Cortex
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
digital-forensicsincident-responseinformation-gathering+5
1.6k14 days ago
thehive-project/cortexCortex: a Powerful Observable Analysis and Active Response Engine
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
magicsword-io/loldriversCurated database of vulnerable and malicious Windows drivers with YARA, Sigma, ClamAV, and Sysmon detection rules for proactive threat hunting and…
bert-janp/open-source-threat-intel-feedsThis repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such…
opencti-platform/connectorsCollection of OpenCTI connectors that ingest and synchronize threat intelligence, IOCs, and CTI data from external sources like MISP and MITRE ATT&CK…
rurik/noribenPython-based malware analysis sandbox that integrates with Sysinternals Procmon to automatically collect, analyze, and report runtime indicators with…
perplexityai/numbatVisibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.
misp/misp-galaxyClusters and elements to attach to MISP events or attributes (like threat actors)
gendigitalinc/iocThreat Intel IoCs + bits and pieces of dark matter. Published by Gen Threat Labs.
mitre-attack/attack-stix-dataSTIX 2.1 collections of the MITRE ATT&CK knowledge base, providing adversary tactics and techniques for enterprise, mobile, and ICS threat…
duggytuxy/data-shield_ipv4_blocklistCurated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…
certtools/intelmqIntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
mgeeky/protectmytoolingMulti-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking,…
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.
stanfrbd/cyberbroA simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
ncsc-nl/php2shellOperational advisory repository tracking CVE-2026-109618 and CVE-2026-109619 PHP RCE flaws, with detection and mitigation guidance, affected software…
aquasecurity/vuln-list-updateAutomated vulnerability data aggregator that collects advisories from NVD, OSV, Alpine, Red Hat, and 20+ other sources into a unified parsable format…