beenuar / AiSOC

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

opencve / opencve

Vulnerability Intelligence Platform

0xSteph / pentest-ai-agents

Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections, audit STIGs, and write reports.

mukul975 / cve-mcp-server

Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.

olafhartong / sysmon-modular

A repository of sysmon configuration modules

redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

apache / caldera

Automated Adversary Emulation Platform

kubescape / kubescape

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

Shuffle / Shuffle

Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

DataDog / stratus-red-team

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

DataDog / KubeHound

Tool for building Kubernetes attack paths

center-for-threat-informed-defense / attack-flow

Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.

Mafifrizi / ARES

ARES - authorized red-team engagement automation with dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting.

joshuagodwin7929 / Purple-Team-Automation

Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&CK.

rabbitstack / fibratus

Security sensor for realtime threat detection and protection

cyb3rxp / awesome-soc

A curated knowledge base to build, run and mature a SOC (including CSIRT).

infosecB / awesome-detection-engineering

Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.

mitre-attack / mitreattack-python

A python module for working with ATT&CK

mitre-attack / attack-stix-data

STIX data representing MITRE ATT&CK

MISP / misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

OpenCTI-Platform / connectors

OpenCTI Connectors

psihijatrija / Sentinel

Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.

mitre-attack / attack-navigator

Web app that provides basic navigation and annotation of ATT&CK matrices

mitre / cti

Cyber Threat Intelligence Repository expressed in STIX 2.0

mrwadams / attackgen

AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.

mrwadams / stride-gpt

An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.

mitre-attack / attack-website

MITRE ATT&CK Website

turbot / tailpipe

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

Ethan-Andrews / ThreatIntel-Aggregator

Self-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineering. Runs standalone or fully Azure-integrated.

Mister-iks / pcybox-attackgraph

Open source browser lab to build a simulated infrastructure, watch an attack move through it, and check whether your defense works.

tsale / jevline

Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.

M-med / Active-Directory-Simulation-Attack-

A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening (gMSA, tiering, LLMNR/NetBIOS disabling) with Wazuh SIEM detection rules mapped to MITRE ATT&CK.

SagarBiswas-MultiHAT / The-BlackHAT-roadmap

The complete hacking & penetration testing roadmap. From beginner to elite. 44,982 lines, 150+ Diagram across the roadmap: OPSEC, web security, Active Directory, binary exploitation, EDR evasion, and 0-day research. 300+ tools, 200+ MITRE techniques, C & Rust payloads, lab guides, books, courses, blogs, practice platforms, and AI security resources

magicsword-io / Magic-Atomics

Prevention-focused living-off-the-land testing framework mapped to MITRE ATT&CK.

kac89 / vulnrepo

VULNRΞPO - Free vulnerability report generator and repository, end-to-end encrypted! Templates of issues, CWE,CVE,MITRE ATT&CK,PCI DSS, import Nmap/Nessus/Burp/OpenVAS/Bugcrowd/Trivy, Jira export, TXT/JSON/MARKDOWN/HTML/DOCX, attachments, automatic changelog, stats, vulnerability management, bugbounty, local ai/llm, super fast pentest reporting!

THREATBYTES / Malware-Analysis-Report-Template

A standardised malware analysis report template with a JSON Schema and Markdown format mapped to MITRE ATT&CK. Validate, share and compare reports consistently. Part of ThreatBytes.