Tools

xghst0/reconkg

Vulnerability triage with provenance. Resolves CVEs from locally built corpora (NVD/KEV/EPSS, ExploitDB, nmap script.db) and emits verification…

functori/argos/argos

Analysis and Representation of Graphs of Suspicious Operations (Analyse et Représentation des Graphes des Opérations Suspectes)

nktris/htsoc

Reproducible SOC lab for CVE-2024-4577 detection and response

adham504/sentinelthread-forensics

High-speed Windows forensic triage platform that orchestrates the Hayabusa engine to transform raw EVTX logs into prioritized threat timelines with…

renat0z3r0/notepadpp-supply-chain-iocs

IoCs and detection rules for the Notepad++ supply chain attack (CVE-2025-15556) — Lotus Blossom APT, June–December 2025. Includes Falcon LogScale…

knqyf263/vuln-list-backup

Collects vulnerability and advisory data from multiple public security feeds and stores it in a parsable, structured format for downstream security…

misp/misp-objects

Curated JSON object templates that define MISP attributes and relationship types for structured threat intelligence sharing and interoperable IOC…

mitre-attack/attack-stix-data

STIX 2.1 collections of the MITRE ATT&CK knowledge base, providing adversary tactics and techniques for enterprise, mobile, and ICS threat…

hslatman/awesome-threat-intelligence

Curated directory of threat intelligence sources, feeds, frameworks, tools, and research for SOC/CTI teams—covering IOCs, STIX/TAXII formats, and…

misp/misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

gnomeman/badbanana-threat-observatory

Threat intel observatory aggregating CISA KEV, ThreatFox, URLhaus, and MalwareBazaar feeds with search, change tracking, and STIX/CSV/JSONL export.

nict-csl/exist

EXIST is a web application for aggregating and analyzing cyber threat intelligence.

grapl-security/grapl

Graph platform for Detection and Response

montysecurity/c2-tracker

Live Feed of C2 servers, tools, and botnets

pedramamini/threatingestor

Automated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…

hurricanelabs/machinae

Automated security intelligence collector that queries public feeds and APIs for threat data on IPs, domains, URLs, hashes, and SSL fingerprints,…

vxunderground/threatintelligencediscordbot

Gets updates from various clearnet domains and ransomware threat actor domains