Packagist · PyPI
MISP/MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
AGPL-3.0Aug 28, 2026 · metrics 2.10.0
All tags
Catalogue tag
#threat-hunting
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
19 records
—
OISF/suricata
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
GPL-2.0Sep 18, 2026 · metrics 2.10.0
Go
cynative/cynative
Open-source framework for security agents with live, read-only access to your infrastructure. Audit AWS, GCP, Azure, Kubernetes, GitHub and GitLab as one system for privilege escalation, public exposure, leaked credentials and more, with agents you write in one markdown file.
Apache-2.0Sep 5, 2026 · metrics 2.10.0
Go · Maven · npm
utmstack/UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
AGPL-3.0Sep 14, 2026 · metrics 2.10.0
crates.io · PyPI
Yamato-Security/hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
AGPL-3.0Oct 12, 2026 · metrics 2.10.0
crates.io
SecurityRonin/forensicnomicon
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
Apache-2.0Oct 20, 2026 · metrics 2.10.0
PyPI
depalmar/ai_for_the_win
Build AI-powered security tools. 50+ hands-on labs covering ML, LLMs, RAG, threat detection, DFIR, and red teaming. Includes Colab notebooks, Docker environment, and CTF challenges.
Custom licenseSep 16, 2026 · metrics 2.10.0
PyPI
mentat-is/gulp
g(ULP) core backend and plugins
Custom licenseJul 17, 2026 · metrics 2.10.0
crates.io
WithSecureLabs/chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
GPL-3.0Sep 10, 2026 · metrics 2.10.0
crates.io
WithSecureOpenSource/chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
GPL-3.0Oct 18, 2026 · metrics 2.10.0
crates.io · npm
backbay-labs/clawdstrike
Agentic AI EDR for developer workstations and autonomous agent swarms. Build Swarm Detection & Response platforms with Clawdstrike.
Apache-2.0Sep 16, 2026 · metrics 2.10.0
—
mukul975/Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Apache-2.0Sep 16, 2026 · metrics 2.10.0
Go
Ashfaaq98/ocsf-console-ir
Console-IR. OCSF-native incident response and investigation TUI for the terminal. Triage findings, pivot on indicators, investigate hosts and accounts, GeoIP and WHOIS enrichment, case management, write the report. Single Go binary, SQLite, no server. Open Cybersecurity Schema Framework security tooling for SOC analysts and DFIR.
AGPL-3.0Sep 19, 2026 · metrics 2.10.0
Go · npm · PyPI
zaneGittins/bifract
Open source log management, detection, and collaboration
AGPL-3.0Sep 24, 2026 · metrics 2.10.0
—
chainguard-dev/osquery-defense-kit
Production-ready detection & response queries for osquery
Apache-2.0Sep 11, 2026 · metrics 2.10.0
Go
ridgelinecyberdefence/vanguard
Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensics, disk collection, remote operations, and Velociraptor management. Works air-gapped, with automated timeline generation.
MITSep 12, 2026 · metrics 2.10.0
PyPI
eremit4/favihunter
Discover and monitor internet assets using favicon hashes across search engines.
MITSep 19, 2026 · metrics 2.10.0
—
mthcht/ThreatHunting-Keywords
Awesome list of keywords and artifacts for Threat Hunting sessions
No licenseSep 16, 2026 · metrics 2.10.0
PyPI
RoomaSec/RmEye
戎码之眼是一个window上的基于att&ck模型的威胁监控工具.有效检测常见的未知威胁与已知威胁.防守方的利剑
Apache-2.0Sep 16, 2026 · metrics 2.10.0