Havuz

Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the tech

Vigil SOC: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.

A vendor-neutral collection of Sigma, YARA, and Suricata rules for detecting compromise of LLM applications, MCP servers, ML supply chains,

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process with

Free open-source OSINT and investigation toolkit for Claude Code: case management, 54 OSINT enrichment adapters, structured analytic techniq

Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation

Agentic DFIR

🛡️ Turnkey cybersecurity lab for Hermes Agent — 397 CVE-driven skills, 152 tools, 28 frameworks (MITRE ATT&CK, MISP, CVSS, EPSS, OWASP, NIST

A blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scorin

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and L

Threat hunting command system for agentic IDEs

Autonomous, read-only endpoint investigation via MCP. Ask a question about your fleet, get a narrative answer with containment recommendatio

Terminal research and study client for MITRE ATT&CK®

Finance & Banking - Advanced Threat Intelligence Plt. & Dynamic Policy Enforcer that ingests OSINT threat feeds, normalizes & scores indicat