RedELK
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
defensive-toolsincident-responseinformation-gathering+4
2.7k
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
abdaullahag/threatlensPython CLI tool for rapid IOC analysis (IPs, Domains, CVEs) using 6 free Threat Intel APIs. Outputs: Color-coded Excel, JSON, CSV. Uses: VT, Shodan,…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
telekom-security/tpotce🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
microsoft/msticpyMicrosoft Threat Intelligence Security Tools
jonrau1/electriceyeElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
seccubus/seccubusEasy automated vulnerability scanning, reporting and analysis
securityclaw/securityclawA modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…
swimlane/soc-fakerA python package for use in generating fake data for SOC and security automation.
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
randomuserid/tyliumPrimary data pipelines for intrusion detection, security analytics and threat hunting
tayontech/scopeAI agent set for cloud security purple teaming, runs inside Claude Code, Gemini CLI, and Codex.
semonte/sisuMounts AWS resources as a local filesystem for infrastructure exploration, security auditing, and configuration analysis using standard Unix tools…
corelight/zeek-endpoint-enrichmentZeek log enrichment tool that adds host information and known entity references to enhance network security monitoring and incident response.
eh-amish/windows-defender-security-auditor-cve-2026-50656-Read-only PowerShell security auditor for Windows endpoints and servers: checks Defender configuration, patch status, credentials, persistence,…
trnguyen03/activemq-ids-ips-labIDS/IPS lab for detecting and preventing Apache ActiveMQ RCE (CVE-2023-46604) using GVM, Nmap, Snort, iptables, and UFW.