Repository Index

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0

• ai-agents
• claude-code
• cybersecurity
• incident-response

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

• forensics
• mobile
• security
• android

This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.

• security
• security-tools
• security-audit
• security-hardening

Main Sigma Rule Repository

• security
• monitoring
• siem
• logging

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

• cowrie
• honeypot
• ssh
• telnet

Collaborative forensic timeline analysis

• forensics
• dfir
• security
• timeline

Modern, privacy-friendly, and detailed web analytics that works without cookies or JS.

• web-analytics
• monitoring
• django
• python

A curated list of resources related to Industrial Control System (ICS) security.

• hacktoberfest
• ics
• iiot
• security

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

What's in your data? Extract schema, statistics and entities from datasets

• python
• privacy
• pii
• npi

ICS/SCADA honeypot

• honeypot
• scada
• ics
• python

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics

Simplifying encrypted traffic analysis for researchers by making protocol decryption effortless.

• frida
• ssl
• security
• hooking

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

Automated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.

• angularjs
• xss
• xss-scanners
• exploit

Open Source SIEM (Security Information and Event Management system).

• siem
• risk-management
• risk-assessment
• vulnerability-management

CLI utility and Python module for analyzing log files and other data.

• log-analysis
• log-parser
• cli
• security

Local-LLM alert triage for self-hosted SOCs.

• homelab
• ids
• llm
• ollama

Stream-first CAN & J1939 toolkit for security research and AI agents — typed JSONL events, CLI, TUI, fuzzing, MCP server.

• automotive-security
• can-bus
• can-bus-hacking
• can-bus-security