beenuar / AiSOC

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

0xSteph / pentest-ai-agents

Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections, audit STIGs, and write reports.

mukul975 / cve-mcp-server

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

olafhartong / sysmon-modular

A repository of sysmon configuration modules

redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

apache / caldera

Automated Adversary Emulation Platform

kubescape / kubescape

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

Shuffle / Shuffle

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

DataDog / stratus-red-team

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

DataDog / KubeHound

Tool for building Kubernetes attack paths

center-for-threat-informed-defense / attack-flow

Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.

Mafifrizi / ARES

ARES - authorized red-team engagement automation with dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting.

joshuagodwin7929 / Purple-Team-Automation

Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&CK.

rabbitstack / fibratus

Security sensor for realtime threat detection and protection

cyb3rxp / awesome-soc

A curated knowledge base to build, run and mature a SOC (including CSIRT).

mitre-attack / mitreattack-python

A python module for working with ATT&CK

mitre-attack / attack-stix-data

STIX data representing MITRE ATT&CK

OpenCTI-Platform / connectors

OpenCTI Connectors

psihijatrija / Sentinel

Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.

mitre-attack / attack-navigator

Web app that provides basic navigation and annotation of ATT&CK matrices

mrwadams / attackgen

AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.

mrwadams / stride-gpt

An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.

mitre-attack / attack-website

MITRE ATT&CK Website

turbot / tailpipe

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

Ethan-Andrews / ThreatIntel-Aggregator

Self-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineering. Runs standalone or fully Azure-integrated.

Mister-iks / pcybox-attackgraph

Open source browser lab to build a simulated infrastructure, watch an attack move through it, and check whether your defense works.

tsale / jevline

Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.

M-med / Active-Directory-Simulation-Attack-

A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening (gMSA, tiering, LLMNR/NetBIOS disabling) with Wazuh SIEM detection rules mapped to MITRE ATT&CK.

SagarBiswas-MultiHAT / The-BlackHAT-roadmap

The complete hacking & penetration testing roadmap. From beginner to elite. 44,982 lines, 150+ Diagram across the roadmap: OPSEC, web security, Active Directory, binary exploitation, EDR evasion, and 0-day research. 300+ tools, 200+ MITRE techniques, C & Rust payloads, lab guides, books, courses, blogs, practice platforms, and AI security resources