Top 23 Threatintel Open-Source Projects

• spiderfoot

  19 11,670 6.6 Python

  SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• awesome-malware-analysis

  8 11,057 0.0

  Defund the Police.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• MISP

  28 4,969 9.9 PHP

  MISP (core software) - Open Source Threat Intelligence and Sharing Platform

  

Project mention: A recent abrupt change in Internet SSH brute force attacks against us | news.ycombinator.com | 2024-02-24

• cowrie

  15 4,904 9.3 Python

  Cowrie SSH/Telnet Honeypot https://cowrie.readthedocs.io

  

Project mention: Brute.Fail Watch brute force attacks in real time | news.ycombinator.com | 2023-06-02

Thanks for the reference; after some link chasing I was able to end up on the project I believe you're thinking of: https://github.com/cowrie/cowrie#features (appears to be BSD-3-Clause: https://github.com/cowrie/cowrie/blob/master/LICENSE.rst )

• sysmon-config

  34 4,565 0.0

  Sysmon configuration file template with default high-quality event tracing

Project mention: Troubleshooting Intermittent Slowness on Network Share | /r/msp | 2023-07-07

https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/networking-overview plenty of windows troubleshooting tips here too, and this is pretty good symon script saves to event viewer even after a reboot! , also care with wireshark as it may give you a false sense of there's a fault, try tcpIPview from sysinternals and yeah procmon for sure. https://github.com/SwiftOnSecurity/sysmon-config use psping to ping the server directly and see the latency goes up and down, you can ping it more often every 1 second so you get a better more detailed resul.

• IntelOwl

  13 3,103 9.6 Python

  IntelOwl: manage your Threat Intelligence at scale

  

Project mention: Monthly Security Checklist | /r/msp | 2023-06-25

• yeti

  2 1,626 9.7 Python

  Your Everyday Threat Intelligence

  

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• SysmonTools

  2 1,445 3.5

  Utilities for Sysmon

• harpoon

  2 1,133 4.7 Python

  CLI tool for open source and threat intelligence (by Te-k)

• ThreatIngestor

  1 781 7.6 Python

  Extract and aggregate threat intelligence.

  

• sysmon-config

  1 749 7.2 PowerShell

  Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events. (by ion-storm)

• ransomwatch

  3 740 10.0 HTML

  the transparent ransomware claim tracker 🥷🏼🧅🖥️

Project mention: Las Vegas | news.ycombinator.com | 2023-09-16

I don’t want to endorse this practice at all but because it is public knowledge,

https://ransomwatch.telemetry.ltd

I trust you will be able to figure out the rest.

• iocextract

  1 485 5.4 Python

  Defanged Indicator of Compromise (IOC) Extractor.

  

• awesome-intelligence-writing

  1 463 1.8

  Awesome collection of great and useful resources concerning intelligence writing such as manuals/guides, standards, books, and articles

• C2IntelFeeds

  1 433 9.9 REXX

  Automatically created C2 Feeds

• PyMISP

  3 418 9.2 Python

  Python library using the MISP Rest API

  

Project mention: FLaNK Stack Weekly for 13 November 2023 | dev.to | 2023-11-13

• misp-training

  1 355 7.9 TeX

  MISP trainings, threat intel and information sharing training materials with source code

  

• Zeek-Intelligence-Feeds

  1 312 7.4 Zeek

  Zeek-Formatted Threat Intelligence Feeds

  

• kestrel-lang

  1 273 9.6 Python

  Kestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.

  

• threatbus

  4 254 0.0 Python

  🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

  

• CloudIntel

  1 219 9.4

  This repo contains IOC, malware and malware analysis associated with Public cloud

Project mention: A list of SaaS, PaaS and IaaS offerings that have free tiers of interest to devops and infradev | dev.to | 2024-02-05

Public Cloud Threat Intelligence — High confidence Indicator of Compromise(IOC) targeting public cloud infrastructure, A portion is available on github (https://github.com/unknownhad/AWSAttacks). Full list is available via API

• malware-ioc

  8 196 6.7 Python

  This repository contains indicators of compromise (IOCs) of our various investigations. (by prodaft)

  

Project mention: PTI-257 Group Indicators of Compromise (IOCs) - PTI-257 consists of former Wizard Spider actors who are publicly known for the various malware variants they use (Ryuk, Trickbot, and Conti, among others) | /r/blueteamsec | 2023-09-14

• Log4Shell-IOCs

  1 184 3.6 Python

  A collection of intelligence about Log4Shell and its exploitation activity.

  

• SaaSHub

  www.saashub.com sponsored

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

Threatintel related posts

• A recent abrupt change in Internet SSH brute force attacks against us
  1 project | news.ycombinator.com | 24 Feb 2024
• Las Vegas
  1 project | news.ycombinator.com | 16 Sep 2023
• Troubleshooting Intermittent Slowness on Network Share
  1 project | /r/msp | 7 Jul 2023
• Sysmon not reading our config.xml-file
  1 project | /r/sysadmin | 21 Jun 2023
• Cheap, Fast, Good and Simple Remote Monitoring for Small Environments
  1 project | /r/msp | 31 May 2023
• How do I exclude specific event IDs in Sysmon?
  1 project | /r/sysadmin | 15 Apr 2023
• Finding the Process initiating a ping
  1 project | /r/netsecstudents | 5 Apr 2023
• A note from our sponsor - InfluxDB
  www.influxdata.com | 24 Apr 2024

  Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality. Learn more →

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com