SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
- footprinting
- osint
- threatintel
- python
Repository Index
55,640 visible repositories in the index
1–24 of 30 · Most stars
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Open Cyber Threat Intelligence Platform
- cyber
- cti
- threat-intelligence
- security
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- ai-security
- alert-triage
- cybersecurity
- detection-engineering
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
- misp
- threat-sharing
- threat-hunting
- threatintel
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
- phishing
- typosquatting
- domains
- dns
ThePhish: an automated phishing email analysis tool
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
- cybersecurity
- threat
- ioc
- malware
Extract and aggregate threat intelligence.
- ioc
- indicators-of-compromise
- threatintel
- threat-intelligence
Tool to gather Threat Intelligence indicators from publicly available sources
Defanged Indicator of Compromise (IOC) Extractor.
- ioc
- indicators-of-compromise
- library
- ioc-extractor
Machinae Security Intelligence Collector
OASIS TC Open Repository: Python APIs for STIX 2
- python
- stix
- stix2
- cyber-threat-intelligence
A modular Python application to collect intelligence for malicious hosts.
- cybersecurity
- investigation
Aggregates security advisories from 10 international CERTs daily and provides an AI skill that cross-references alerts against your project's tech stack.
- cve
- security
- security-alerts
- vulnerability
Z-Hound — a CSV-first collector that finds public threat reports and extracts structured IoCs without a database, LLM, or API key.
Collecting & Hunting for IOCs with gusto and style
- threat
- hunting
- ioc
- security-tools
Protect your SIP Servers from bad actors at https://sentrypeer.org
- sip
- voip
- security-tools
- honeypot
Threat Intelligence Quotient Test - Dataviz and Statistical Analysis of TI feeds
Open Source Threat Intelligence Platform
- cti
- cybersecurity
- security
- intelligence
Every hack, exploit and breach, live: new vulnerabilities, active exploits and breaches on one globe, with sources and one-click fixes.
A set of Maltego transforms for VirusTotal Public API v2.0. This set has the added functionality of caching queries on a daily basis to speed up resolutions.
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
- claude-code
- cti
- llm
- rag