Tools

jamf/aftermath

Swift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…

spaceraccoon/manuka

A modular OSINT honeypot for blue teamers

cynative/cynative

Read-only AI agent that queries your cloud, code, and runtime infrastructure to surface misconfigurations, leaked secrets, and privilege escalation…

ttlab-research/awesome-wazuh

🛡️Awesome lists about all kinds of interesting topics of Wazuh XDR/SIEM

nccgroup/typofinder

A finder of domain typos showing country of IP address

cred-club/artif

An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.

mangod12/onealert

AI-powered SOC for OT/ICS networks — 6 autonomous agents, MITRE ATT&CK mapping, Suricata/Zeek ingestion, human-in-the-loop response, 330+ tests.…

salespeak-ai/buyer-eval-skill

B2B software vendor evaluation skill for Claude Code — domain-expert questions, vendor AI agent conversations, evidence-based scoring

expert21/hermes-osint

Hermes — an ephemeral, Docker-powered OSINT framework for testing, tinkering, and secure investigative automation.

nccgroup/yaml2yara

Generate bulk YARA rules from YAML input

c0oki3s/veilgate

Asymmetric defense against adversarial AI agents. VeilGate evaluates each incoming request, redirects suspected agents into a per-IP-consistent…

trappsec-dev/trappsec

Open-source framework for embedding realistic decoy routes and honey fields into APIs to detect attackers probing business logic, converting…

aarocy/recon-scan

Recon-Scan: open‑source passive reconnaissance with AI‑powered security analysis. Zero‑touch, developer‑first, and privacy‑focused.

chpratik/nginx_2026_cve_bundle_cti_report

Covered CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533

jeromesegura/ekfiddle

Your Swiss Army knife to analyze malicious web traffic based on the popular Fiddler web debugger.