Vigil is an open-source AI SOC (Security Operations Center) platform that orchestrates autonomous threat hunting, incident response, and case management through a multi-agent architecture. The system ingests security findings from SIEMs (Splunk, Elastic, Azure Sentinel), EDRs (CrowdStrike, Microsoft Defender), and other sources via Kafka or webhooks, then uses LLM-driven agents (hunt, root_cause, adjudicate, investigate, compose, chat) to analyze, enrich, and respond. A TypeScript agent layer with event-sourced ledgers and budget enforcement runs investigations, while a Python daemon handles polling, deduplication, and orchestration. The platform exposes its own tools via MCP (Model Context Protocol) and integrates with 30+ external security tools through a descriptor-based plugin system. The frontend is a React SPA with a setup wizard, dashboards, and case management UI. Deployment is via Docker Compose or Helm, with PostgreSQL, Redis, and optional Kafka as backing services.
IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
LiME is a Linux kernel module (LKM) for volatile memory acquisition from Linux and Android systems, widely used in digital forensics and incident response. It dumps physical memory ranges marked as "System RAM" by walking the kernel's iomem resource tree, writing output to a local file or streaming over a TCP connection. The module supports three output formats (raw, padded, and lime with metadata headers), optional zlib compression, optional cryptographic digest sidecar files (leveraging the kernel's crypto API), and direct I/O. It minimizes interaction with user space during capture to produce more forensically sound images. The architecture is a classic kernel module with clearly separated concerns: main.c drives the iomem traversal and orchestrates output via vtable-like structures; tcp.c and disk.c provide network and file-system transport; hash.c wraps three generations of kernel crypto APIs (ahash, hash, tfm) for portable digest support; and deflate.c wraps zlib with balanced memory settings. The codebase is aggressively version-aware, supporting kernels from 2.6.11 through 6.19 with conditionally compiled code paths for API breakpoints (e.g., set_fs removal, kmap_local_page, sock_set_reuseaddr). The project ships an exceptionally thorough CI/CD pipeline (GitHub Actions) that compiles against eight pinned kernel series and a canary latest-kernel build, runs sparse static analysis and custom grep-based source checks, and boots real kernels in QEMU to perform runtime smoke tests of all output formats, digest, and compression. A self-contained local testing harness (Docker) enables developers to reproduce the full CI matrix offline. Configuration management, kernel tree caching, and version pinning are handled by well-documented scripts that are themselves reusable for other kernel module projects.
AutoRuns is a PowerShell module for live incident response that enumerates Windows autorun artifacts used by legitimate programs and malware to achieve persistence. It scans over 20 categories of autostart execution points (ASEPs) including registry keys (Run, RunOnce, BootExecute, AppInit, etc.), file system locations (Startup folders), scheduled tasks, WMI subscriptions, services and drivers, Office addins, and more. The module provides three main functions: Get-PSAutorun to collect artifacts, New-AutoRunsBaseLine to create a baseline snapshot, and Compare-AutoRunsBaseLine to compare two baselines for change detection. It supports optional file hashing (MD5, SHA1, SHA256) and digital signature verification via Get-AuthenticodeSignature. The architecture is a single PowerShell script module (AutoRuns.psm1) with internal helper functions for registry reading, path normalization, and command-line parsing. It relies solely on PowerShell 4.0+ and Windows built-in APIs, with no external dependencies. The module is designed for forensic analysts and incident responders to quickly identify persistence mechanisms on a live Windows system.
This is a comprehensive command-line tool and self-hosted web server for network reconnaissance, written entirely in Bash. It performs ASN lookups, BGP statistics, RPKI validation, IP geolocation, IP reputation checks (via StopForumSpam, IPQualityScore, GreyNoise), Shodan InternetDB scanning for open ports and vulnerabilities, AS path tracing with detailed hop information, and more. The architecture is a monolithic Bash script (~7000 lines) that integrates numerous public APIs (RIPEStat, Team Cymru, pWhois, PeeringDB, CAIDA, ipinfo.io, ip-api, Cloudflare Radar, etc.) and command-line tools (mtr, whois, jq, curl, ncat). It can run in interactive mode, JSON output mode (as an API), or as an HTTP server (using ncat) that generates HTML reports with clickable links and a bookmarklet for browser integration. The code is well-structured for a shell script, with extensive error handling, caching of API responses, and support for API tokens to enhance functionality. While it is not modular in a traditional sense (everything is in one file), it demonstrates high craftsmanship in Bash and is actively maintained.
GreedyBear is a threat intelligence platform that consumes honeypot logs from T-Pot clusters (Cowrie, Heralding, Tanner, etc.), extracts Indicators of Compromise (IOCs), enriches them with external threat feeds (ThreatFox, AbuseIPDB, FireHol, Spamhaus, MalwareBazaar), and applies machine learning scoring (Random Forest) to predict recurrence probability and expected interactions. The system exposes public and authenticated APIs in multiple formats (JSON, NDJSON, CSV, TXT, STIX 2.1) for threat researchers and supports event ingestion from external sensors. The backend is built with Django/DRF, PostgreSQL, and Elasticsearch, orchestrated via Django-Q cronjobs for scheduled extraction, enrichment, and cleanup. A React SPA frontend provides a customizable dashboard with attack maps, trending attackers, and feed browsing. The architecture uses repository, strategy, and factory patterns, with a clean separation between extraction pipelines, scoring, and API layers. While primarily an application, it has strong data engineering components—ETL pipelines, ML scoring, clustering (MinHash LSH for command sequences), and data enrichment—making it a hybrid that leans application.
This repository is a comprehensive library of machine-readable taxonomies (machine tags) for threat intelligence and information sharing, primarily designed for the MISP platform. It contains over 200 taxonomy definitions in a standardized JSON format, each defining a namespace with predicates and values for tagging events, attributes, and indicators. The taxonomies cover a wide range of domains including cyber incident classification, malware analysis, information handling policies (TLP, PAP, IEP), regulatory compliance (GDPR, NIS2, EU AI Act), attack modeling (kill chain, Diamond Model), and specialized areas like disinformation, AI safety, and drone classification. While the core content is data, the repository also includes a set of reusable Python tools for validation, generation, and conversion of taxonomies, as well as CI/CD pipelines and a JSON schema. The hybrid nature is evident: it is primarily a data library but with significant application-like tooling for maintaining and extending the taxonomy collection.
This repository is a curated list of tools and resources for security incident response and digital forensics (DFIR). It is organized into categories such as adversary emulation, evidence collection, log analysis tools, memory analysis tools, and more. Each entry includes a link and a brief description. The project includes GitHub Actions workflows to automatically check for broken URLs in the documentation and to lint the README for spelling errors, ensuring the list remains accurate and well-maintained. The primary value of this repository lies in its comprehensive collection of DFIR resources, which serves as a reference for security analysts and teams. The maintenance workflows demonstrate a commitment to data quality by proactively validating links and checking for spelling errors, which is essential for a resource list that relies on external URLs. While the repository does not contain complex data pipelines or analytical code, it effectively fulfills its purpose as a reference list through structured markdown and automated upkeep.
This repository is a curated 'awesome list' of threat detection and hunting resources. It does not contain any executable code, application logic, or data pipelines. The content is purely a markdown document (README.md) and its HTML equivalent, along with a small number of PDF guides. The repository functions as an index of links to external tools (e.g., osquery, Sigma, HELK), datasets (e.g., Mordor, BOTS), frameworks (MITRE ATT&CK), blogs, videos, and training resources. It is a static, non-functional reference directory. While it serves as a valuable starting point for security professionals, it has no software architecture, no entry points, no data flows, and no reusable code components. Its value lies in curation and organization rather than engineering.
This repository, branded as "The Malware Bible," is a curated educational knowledge base for cybersecurity, malware analysis, reverse engineering, and exploit development. It is not a conventional software application or an operational data pipeline; under the available classifications it is closest to data/research because its core assets are reference documentation, course-style Markdown modules, and research-oriented binaries rather than runnable application code. The content is organized into four learning paths: The Beginning (C, Python, x86 assembly, shellcode, reverse engineering basics), The Journey (PE/ELF structures, Android/iOS package formats), The Rituals (obfuscation, evasion, and writing malware), and The Scriptures (tool cheatsheets for radare2, IDA Pro, WinDbg, YARA, WinAPI, and evasion tactics). In practice, the repository serves as a self-study curriculum and analyst reference, not as a deployable system. It includes a large Windows DLL export catalog in Markdown, example ELF binaries demonstrating heap overflow, use-after-free, ROP chains and format string bugs, and numerous screenshots/diagrams. There is no CI/CD, dependency management, or automated testing; several files are marked "Coming soon" or "WORK IN PROGRESS," and external links or sponsor images may rot over time. The Windows API and DLL reference content is broad but may drift as Windows evolves. The last commit is recent, indicating active maintenance, and the repository benefits from a structured table of contents and consistent formatting across chapters.
This repository is a curated directory of cybersecurity tools and resources, organized into categories such as AI security, API pentesting, C2 frameworks, forensics, OSINT, and more. It is built as a static documentation site using Retype, with markdown pages listing external links and brief descriptions. The repository contains no executable application code, data pipelines, or analytical models. Its primary function is to serve as a reference index for security professionals, maintained through periodic updates to links and categories. The codebase is essentially a collection of markdown files and configuration for the static site generator, with a large set of default password text files included as a resource. There is no software architecture, entry points, or data flows beyond the static site generation. The repo is well-organized and regularly updated, but it offers no reusable software components or novel engineering patterns.
LinuxGun is a collection of Bash shell scripts for Linux security incident response and system hardening. The core scripts (`linuxGun.sh`, `linuxGunPro.sh`, `linuxcheck.sh`) perform comprehensive checks across system information, user accounts, network connections, processes, files, logs, backdoors, tunnels, webshells, malware, memory, hacker tools, kernel modules, Kubernetes, and baseline security configurations. The toolset is designed for emergency triage by system administrators and security analysts, with color-coded output and modular function organization. It includes auxiliary tools for IP blocking (`blockIP.sh`), network interface monitoring (`monitorInter.sh`), process-to-IP connection mapping (`monitorPs2Ip.sh`), and a file upload server (`uploadServer.py`) for transmitting results. The repository also contains AI skill definitions (in `AI-skills/old/`) that describe an automated incident response workflow via SSH, though these appear to be experimental or deprecated. The codebase is functional but shows signs of rapid iteration, hardcoded assumptions (CentOS 7, specific command availability), incomplete modules, and mixed-language comments (Chinese/English). It is not a polished library but a practical, field-tested toolkit for Linux forensics.
This repository is a curated list of open-source AWS security tools, organized into categories such as defensive hardening, offensive testing, purple teaming, continuous auditing, DFIR, development security, S3 auditing, and training. It also includes a Packer-based build system to create an Amazon Machine Image (AMI) pre-loaded with many of the listed tools, alongside scripts for cloning tool repositories (install-tools.sh) and generating markdown tables from CSV data (arsenal-kreator.sh). The actual code in the repo is minimal—mainly configuration and simple shell scripts—and the core value is the comprehensive reference list. The AMI build is dated (last manifest from 2018) and many linked tools may have moved or become unmaintained, resulting in significant technical drift. The repo is more of a historic index than an actively developed software project.