Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.
Repository Index
47,133 repositories indexed
49–72 of 110 · Most stars
Tenzir is the data pipeline engine for security teams.
- incident-response
- threathunting
- siem
- soc
Scirius is a web application for Suricata ruleset management and threat hunting.
- python
- security
- management
- interface
MARA is a Mobile Application Reverse engineering and Analysis Framework. It is a toolkit that puts together commonly used mobile application reverse engineering and analysis tools to assist in testing mobile applications against the OWASP mobile security threats.
Learn cloud security by building it! An open-source homelab teaching Zero Trust, DevSecOps, IaC, and cloud architecture from the ground up.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Tool to gather Threat Intelligence indicators from publicly available sources
Defanged Indicator of Compromise (IOC) Extractor.
- ioc
- indicators-of-compromise
- library
- ioc-extractor
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
MQTT-PWN intends to be a one-stop-shop for IoT Broker penetration-testing and security assessment operations.
- python
- mqtt
- mqtt-broker
- mqtt-client
Firewall and Privatizing Proxy for Trackers, Attackers, Malware, Adware, and Spammers with Anti-Virus On-Demand and On-Access Scanning (PF, squid, privoxy, hphosts, dshield, emergingthreats, hostsfile, PAC file, clamav)
OASIS TC Open Repository: Python APIs for STIX 2
- python
- stix
- stix2
- cyber-threat-intelligence
Cyber Incident Response Team Playbook Battle Cards
- playbook-battle-cards
- cybersecurity
- cyber-threats
- cyber-security-team
Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.
- agent-security
- ai-security
- llm-security
- mcp-security
A powerful and user-friendly browser extension that streamlines investigations for security professionals.
- browser-extension
- chrome-extension
- cybersecurity
- threat-analysis
A curated list of resources about detecting threats and defending Kubernetes systems.
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
Threat modeling for AI coding agents: point Claude Code, Codex or any agent at your repo and get an evidence-traced threat model. 36 architectures, 29 methods, MIT.
A Python RESTful API framework for online malware analysis and threat intelligence services.
The Elevation of Privilege Threat Modeling Game
Python installable command line utiltity for mitigation of host and key compromises.
✨ A compilation of suggested tools/services for each component in a detection and response pipeline, along with real-world examples. The purpose is to create a reference hub for designing effective threat detection and response pipelines. 👷 🏗
Splunk code (SPL) for serious threat hunters and detection engineers.
- splunk
- threat-hunting
- use-case
- siem