SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
- footprinting
- osint
- threatintel
- python
Repository Index
73,362 visible repositories in the index
1–24 of 25 · Most stars
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
- misp
- threat-sharing
- threat-hunting
- threatintel
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
- phishing
- typosquatting
- domains
- dns
IntelOwl: manage your Threat Intelligence at scale
- security-tools
- python
- threat-intelligence
- ioc
Web app that provides basic navigation and annotation of ATT&CK matrices
- cti
- cyber-threat-intelligence
- mitre-attack
- mitre-corporation
Detect Tactics, Techniques & Combat Threats
ThePhish: an automated phishing email analysis tool
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
- cybersecurity
- threat
- ioc
- malware
Extract and aggregate threat intelligence.
- ioc
- indicators-of-compromise
- threatintel
- threat-intelligence
Multi-chain crypto wallet risk scanner for AML/KYT screening. Scores addresses 0–100 using sanctions, risky contracts and fund tracing. Integrates 6 intelligence providers with failover, detects scams, hacks, mixers and phishing, supports 15+ chains, batch screening and TXT/JSON/CSV/HTML/PDF reports. Python, cross-platform.
- aml
- antimoneylaundering
- blockchain-intelligence
- blockchain-security-solutions
OpenSOC Apache Hadoop Code
Defanged Indicator of Compromise (IOC) Extractor.
- ioc
- indicators-of-compromise
- library
- ioc-extractor
Aggregates security advisories from 10 international CERTs daily and provides an AI skill that cross-references alerts against your project's tech stack.
- cve
- security
- security-alerts
- vulnerability
Sandia Cyber Omni Tracker (SCOT)
- perl
- javascript
- cyber-security
- incident-response
Protect your SIP Servers from bad actors at https://sentrypeer.org
- sip
- voip
- security-tools
- honeypot
Multithreaded threat Intelligence gathering built with Python3
- carbonblack
- python
- threatintel
A set of Maltego transforms for VirusTotal Public API v2.0. This set has the added functionality of caching queries on a daily basis to speed up resolutions.
ThreatTracker is a Python script designed to monitor and generate alerts on given sets of indicators of compromise (IOCs) indexed by a set of Google Custom Search Engines.
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
- claude-code
- cti
- llm
- rag
Advanced Phishing Protection: Suricata rulesets open and free
- anti-phishing
- antiphishing
- openphish
- phishing
Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation, and SIEM validation.
Prompt-injection firewall for LLM applications — 33 input detectors, 9 output scanners, federated ed25519-signed threat-intel feed. Apache 2.0, 1040 tests, F1 96.0% with 0% false positives. Docker, GitHub Action, LangChain/LlamaIndex/CrewAI integrations.
- agentic-ai
- ai-safety
- fastapi
- langchain