[38;5;12m                                                                     [39m[38;2;255;187;0m[1m[4mAwesome Cybersecurity Blue Team [0m[38;5;14m[1m[4m![0m[38;2;255;187;0m[1m[4mAwesome[0m[38;5;14m[1m[4m (https://awesome.re/badge-flat2.svg)[0m[38;2;255;187;0m[1m[4m (https://awesome.re)[0m

[38;5;11m[1m▐[0m[38;5;12m [39m[38;5;12mA collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.[39m

[38;5;14m[1mCybersecurity[0m[38;5;14m[1m [0m[38;5;14m[1mblue[0m[38;5;14m[1m [0m[38;5;14m[1mteams[0m[38;5;12m [39m[38;5;12m(https://en.wikipedia.org/wiki/Blue_team_(computer_security))[39m[38;5;12m [39m[38;5;12mare[39m[38;5;12m [39m[38;5;12mgroups[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mindividuals[39m[38;5;12m [39m[38;5;12mwho[39m[38;5;12m [39m[38;5;12midentify[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m[38;5;12mflaws[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12minformation[39m[38;5;12m [39m[38;5;12mtechnology[39m[38;5;12m [39m[38;5;12msystems,[39m[38;5;12m [39m[38;5;12mverify[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12meffectiveness[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m[38;5;12mmeasures,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mmonitor[39m[38;5;12m [39m
[38;5;12mthe[39m[38;5;12m [39m[38;5;12msystems[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mensure[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mimplemented[39m[38;5;12m [39m[38;5;12mdefensive[39m[38;5;12m [39m[38;5;12mmeasures[39m[38;5;12m [39m[38;5;12mremain[39m[38;5;12m [39m[38;5;12meffective[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mfuture.[39m[38;5;12m [39m[38;5;12mWhile[39m[38;5;12m [39m[38;5;12mnot[39m[38;5;12m [39m[38;5;12mexclusive,[39m[38;5;12m [39m[38;5;12mthis[39m[38;5;12m [39m[38;5;12mlist[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12mheavily[39m[38;5;12m [39m[38;5;12mbiased[39m[38;5;12m [39m[38;5;12mtowards[39m[38;5;12m [39m[38;5;14m[1mFree[0m[38;5;14m[1m [0m[38;5;14m[1mSoftware[0m[38;5;12m [39m[38;5;12m(https://www.gnu.org/philosophy/free-sw.html)[39m[38;5;12m [39m[38;5;12mprojects[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12magainst[39m[38;5;12m [39m
[38;5;12mproprietary[39m[38;5;12m [39m[38;5;12mproducts[39m[38;5;12m [39m[38;5;12mor[39m[38;5;12m [39m[38;5;12mcorporate[39m[38;5;12m [39m[38;5;12mservices.[39m[38;5;12m [39m[38;5;12mFor[39m[38;5;12m [39m[38;5;12moffensive[39m[38;5;12m [39m[38;5;12mTTPs,[39m[38;5;12m [39m[38;5;12mplease[39m[38;5;12m [39m[38;5;12msee[39m[38;5;12m [39m[38;5;14m[1mawesome-pentest[0m[38;5;12m [39m[38;5;12m(https://github.com/fabacab/awesome-pentest).[39m

[38;5;12mYour[39m[38;5;12m [39m[38;5;12mcontributions[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12msuggestions[39m[38;5;12m [39m[38;5;12mare[39m[38;5;12m [39m[38;5;12mheartily[39m[38;5;12m [39m[38;5;12m♥[39m[38;5;12m [39m[38;5;12mwelcome.[39m[38;5;12m [39m[38;5;12m(✿◕‿◕).[39m[38;5;12m [39m[38;5;12mPlease[39m[38;5;12m [39m[38;5;12mcheck[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;14m[1mContributing[0m[38;5;14m[1m [0m[38;5;14m[1mGuidelines[0m[38;5;12m [39m[38;5;12m(CONTRIBUTING.md)[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mmore[39m[38;5;12m [39m[38;5;12mdetails.[39m[38;5;12m [39m[38;5;12mThis[39m[38;5;12m [39m[38;5;12mwork[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12mlicensed[39m[38;5;12m [39m[38;5;12munder[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;14m[1mCreative[0m[38;5;14m[1m [0m[38;5;14m[1mCommons[0m[38;5;14m[1m [0m[38;5;14m[1mAttribution[0m[38;5;14m[1m [0m[38;5;14m[1m4.0[0m[38;5;14m[1m [0m[38;5;14m[1mInternational[0m[38;5;14m[1m [0m[38;5;14m[1mLicense[0m[38;5;12m [39m
[38;5;12m(http://creativecommons.org/licenses/by/4.0/).[39m

[38;5;12mMany[39m[38;5;12m [39m[38;5;12mcybersecurity[39m[38;5;12m [39m[38;5;12mprofessionals[39m[38;5;12m [39m[38;5;12menable[39m[38;5;12m [39m[38;5;12mracist[39m[38;5;12m [39m[38;5;12mstate[39m[38;5;12m [39m[38;5;12mviolence,[39m[38;5;12m [39m[38;5;12mwittingly[39m[38;5;12m [39m[38;5;12mor[39m[38;5;12m [39m[38;5;12munwittingly,[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mproviding[39m[38;5;12m [39m[38;5;12mservices[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mlocal,[39m[38;5;12m [39m[38;5;12mstate,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mfederal[39m[38;5;12m [39m[38;5;12mpolicing[39m[38;5;12m [39m[38;5;12magencies[39m[38;5;12m [39m[38;5;12mor[39m[38;5;12m [39m[38;5;12motherwise[39m[38;5;12m [39m[38;5;12mcooperating[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12msimilar[39m[38;5;12m [39m[38;5;12minstitutions[39m[38;5;12m [39m[38;5;12mwho[39m[38;5;12m [39m[38;5;12mdo[39m[38;5;12m [39m[38;5;12mso.[39m[38;5;12m [39m[38;5;12mThis[39m[38;5;12m [39m[38;5;12mevil[39m[38;5;12m [39m[38;5;12mmost[39m[38;5;12m [39m
[38;5;12moften[39m[38;5;12m [39m[38;5;12mhappens[39m[38;5;12m [39m[38;5;12mthrough[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mcoercive[39m[38;5;12m [39m[38;5;12mmechanism[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12memployment[39m[38;5;12m [39m[38;5;12munder[39m[38;5;12m [39m[38;5;12mthreat[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mlack[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12maccess[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mfood,[39m[38;5;12m [39m[38;5;12mshelter,[39m[38;5;12m [39m[38;5;12mor[39m[38;5;12m [39m[38;5;12mhealthcare.[39m[38;5;12m [39m[38;5;12mDespite[39m[38;5;12m [39m[38;5;12mthis[39m[38;5;12m [39m[38;5;12mlist's[39m[38;5;12m [39m[38;5;12mpublic[39m[38;5;12m [39m[38;5;12mavailability,[39m[38;5;12m [39m[38;5;12mit[39m[38;5;12m [39m[38;5;12mis[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mmaintainer's[39m[38;5;12m [39m[38;5;12mintention[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mhope[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mthis[39m[38;5;12m [39m[38;5;12mlist[39m[38;5;12m [39m[38;5;12msupports[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m
[38;5;12mpeople[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12morganizations[39m[38;5;12m [39m[38;5;12mwho[39m[38;5;12m [39m[38;5;12mwork[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mcounter[39m[38;5;12m [39m[38;5;12msuch[39m[38;5;12m [39m[38;5;12mmassive[39m[38;5;12m [39m[38;5;12malbeit[39m[38;5;12m [39m[38;5;12mbanal[39m[38;5;12m [39m[38;5;12mevil.[39m

[38;5;12m![39m[38;5;14m[1mImage[0m[38;5;14m[1m [0m[38;5;14m[1mof[0m[38;5;14m[1m [0m[38;5;14m[1ma[0m[38;5;14m[1m [0m[38;5;14m[1mraised[0m[38;5;14m[1m [0m[38;5;14m[1mfist[0m[38;5;14m[1m [0m[38;5;14m[1mcomposed[0m[38;5;14m[1m [0m[38;5;14m[1mof[0m[38;5;14m[1m [0m[38;5;14m[1mthe[0m[38;5;14m[1m [0m[38;5;14m[1mnames[0m[38;5;14m[1m [0m[38;5;14m[1mof[0m[38;5;14m[1m [0m[38;5;14m[1mBlack[0m[38;5;14m[1m [0m[38;5;14m[1mpeople[0m[38;5;14m[1m [0m[38;5;14m[1mmurdered[0m[38;5;14m[1m [0m[38;5;14m[1mby[0m[38;5;14m[1m [0m[38;5;14m[1mtaxpayer-funded[0m[38;5;14m[1m [0m[38;5;14m[1mracist[0m[38;5;14m[1m [0m[38;5;14m[1mpolice[0m[38;5;14m[1m [0m[38;5;14m[1mviolence.[0m[38;5;12m [39m
[38;5;12m(https://web.archive.org/web/20201028021653if_/https://lauerrealtygroup.com/wp-content/uploads/2020/06/BLM-FIST-scaled.jpg)[39m

[38;5;12m![39m[38;5;14m[1mImage of a "Blue Lives Matter" flag with the thin blue line being peeled away to reveal a Nazi swastika underneath.[0m[38;5;12m (https://web.archive.org/web/20201123181815if_/https://i.redd.it/86pl28p0dl631.jpg)[39m

[38;5;12mDEFUND THE POLICE.[39m[38;5;14m[1m (https://defundthepolice.org/)[0m

[38;2;255;187;0m[4mContents[0m

[38;5;12m- [39m[38;5;14m[1mAutomation[0m[38;5;12m (#automation)[39m
[38;5;12m  - [39m[38;5;14m[1mCode libraries and bindings[0m[38;5;12m (#code-libraries-and-bindings)[39m
[38;5;12m  - [39m[38;5;14m[1mSecurity Orchestration, Automation, and Response (SOAR)[0m[38;5;12m (#security-orchestration-automation-and-response-soar)[39m
[38;5;12m- [39m[38;5;14m[1mCloud platform security[0m[38;5;12m (#cloud-platform-security)[39m
[38;5;12m  - [39m[38;5;14m[1mDistributed monitoring[0m[38;5;12m (#distributed-monitoring)[39m
[38;5;12m  - [39m[38;5;14m[1mKubernetes[0m[38;5;12m (#kubernetes)[39m
[38;5;12m  - [39m[38;5;14m[1mService meshes[0m[38;5;12m (#service-meshes)[39m
[38;5;12m- [39m[38;5;14m[1mCommunications security (COMSEC)[0m[38;5;12m (#communications-security-comsec)[39m
[38;5;12m- [39m[38;5;14m[1mDevSecOps[0m[38;5;12m (#devsecops)[39m
[38;5;12m  - [39m[38;5;14m[1mApplication or Binary Hardening[0m[38;5;12m (#application-or-binary-hardening)[39m
[38;5;12m  - [39m[38;5;14m[1mCompliance testing and reporting[0m[38;5;12m (#compliance-testing-and-reporting)[39m
[38;5;12m  - [39m[38;5;14m[1mDependency confusion[0m[38;5;12m (#dependency-confusion)[39m
[38;5;12m  - [39m[38;5;14m[1mFuzzing[0m[38;5;12m (#fuzzing)[39m
[38;5;12m  - [39m[38;5;14m[1mPolicy enforcement[0m[38;5;12m (#policy-enforcement)[39m
[38;5;12m  - [39m[38;5;14m[1mSupply chain security[0m[38;5;12m (#supply-chain-security)[39m
[38;5;12m- [39m[38;5;14m[1mHoneypots[0m[38;5;12m (#honeypots)[39m
[38;5;12m  - [39m[38;5;14m[1mTarpits[0m[38;5;12m (#tarpits)[39m
[38;5;12m- [39m[38;5;14m[1mHost-based tools[0m[38;5;12m (#host-based-tools)[39m
[38;5;12m  - [39m[38;5;14m[1mSandboxes[0m[38;5;12m (#sandboxes)[39m
[38;5;12m- [39m[38;5;14m[1mIdentity and AuthN/AuthZ[0m[38;5;12m (#identity-and-authnauthz)[39m
[38;5;12m- [39m[38;5;14m[1mIncident Response tools[0m[38;5;12m (#incident-response-tools)[39m
[38;5;12m  - [39m[38;5;14m[1mIR management consoles[0m[38;5;12m (#ir-management-consoles)[39m
[38;5;12m  - [39m[38;5;14m[1mEvidence collection[0m[38;5;12m (#evidence-collection)[39m
[38;5;12m- [39m[38;5;14m[1mNetwork perimeter defenses[0m[38;5;12m (#network-perimeter-defenses)[39m
[38;5;12m  - [39m[38;5;14m[1mFirewall appliances or distributions[0m[38;5;12m (#firewall-appliances-or-distributions)[39m
[38;5;12m- [39m[38;5;14m[1mOperating System distributions[0m[38;5;12m (#operating-system-distributions)[39m
[38;5;12m- [39m[38;5;14m[1mPhishing awareness and reporting[0m[38;5;12m (#phishing-awareness-and-reporting)[39m
[38;5;12m- [39m[38;5;14m[1mPreparedness training and wargaming[0m[38;5;12m (#preparedness-training-and-wargaming)[39m
[38;5;12m  - [39m[38;5;14m[1mPost-engagement analysis and reporting[0m[38;5;12m (#post-engagement-analysis-and-reporting)[39m
[38;5;12m- [39m[38;5;14m[1mSecurity configurations[0m[38;5;12m (#security-configurations)[39m
[38;5;12m- [39m[38;5;14m[1mSecurity monitoring[0m[38;5;12m (#security-monitoring)[39m
[38;5;12m  - [39m[38;5;14m[1mEndpoint Detection and Response (EDR)[0m[38;5;12m (#endpoint-detection-and-response-edr)[39m
[38;5;12m  - [39m[38;5;14m[1mNetwork Security Monitoring (NSM)[0m[38;5;12m (#network-security-monitoring-nsm)[39m
[38;5;12m  - [39m[38;5;14m[1mSecurity Information and Event Management (SIEM)[0m[38;5;12m (#security-information-and-event-management-siem)[39m
[38;5;12m  - [39m[38;5;14m[1mService and performance monitoring[0m[38;5;12m (#service-and-performance-monitoring)[39m
[38;5;12m  - [39m[38;5;14m[1mThreat hunting[0m[38;5;12m (#threat-hunting)[39m
[38;5;12m- [39m[38;5;14m[1mThreat intelligence[0m[38;5;12m (#threat-intelligence)[39m
[38;5;12m  - [39m[38;5;14m[1mFingerprinting[0m[38;5;12m (#fingerprinting)[39m
[38;5;12m  - [39m[38;5;14m[1mThreat signature packages and collections[0m[38;5;12m (#threat-signature-packages-and-collections)[39m
[38;5;12m- [39m[38;5;14m[1mTor Onion service defenses[0m[38;5;12m (#tor-onion-service-defenses)[39m
[38;5;12m- [39m[38;5;14m[1mTransport-layer defenses[0m[38;5;12m (#transport-layer-defenses)[39m
[38;5;12m  - [39m[38;5;14m[1mOverlay and Virtual Private Networks (VPNs)[0m[38;5;12m (#overlay-and-virtual-private-networks-vpns)[39m
[38;5;12m- [39m[38;5;14m[1mmacOS-based defenses[0m[38;5;12m (#macos-based-defenses)[39m
[38;5;12m- [39m[38;5;14m[1mWindows-based defenses[0m[38;5;12m (#windows-based-defenses)[39m
[38;5;12m  - [39m[38;5;14m[1mActive Directory[0m[38;5;12m (#active-directory)[39m

[38;2;255;187;0m[4mAutomation[0m

[38;5;12m- [39m[38;5;14m[1mAnsible Lockdown[0m[38;5;12m (https://ansiblelockdown.io/) - Curated collection of information security themed Ansible roles that are both vetted and actively maintained.[39m
[38;5;12m- [39m[38;5;14m[1mClevis[0m[38;5;12m (https://github.com/latchset/clevis) - Plugable framework for automated decryption, often used as a Tang client.[39m
[38;5;12m- [39m[38;5;14m[1mDShell[0m[38;5;12m (https://github.com/USArmyResearchLab/Dshell) - Extensible network forensic analysis framework written in Python that enables rapid development of plugins to support the dissection of network packet captures.[39m
[38;5;12m- [39m[38;5;14m[1mDev-Sec.io[0m[38;5;12m (https://dev-sec.io/) - Server hardening framework providing Ansible, Chef, and Puppet implementations of various baseline security configurations.[39m
[38;5;12m- [39m[38;5;14m[1mpeepdf[0m[38;5;12m (https://eternal-todo.com/tools/peepdf-pdf-analysis-tool) - Scriptable PDF file analyzer.[39m
[38;5;12m- [39m[38;5;14m[1mPyREBox[0m[38;5;12m (https://talosintelligence.com/pyrebox) - Python-scriptable reverse engineering sandbox, based on QEMU.[39m
[38;5;12m- [39m[38;5;14m[1mWatchtower[0m[38;5;12m (https://containrrr.dev/watchtower/) - Container-based solution for automating Docker container base image updates, providing an unattended upgrade experience.[39m

[38;2;255;187;0m[4mCode libraries and bindings[0m

[38;5;12m- [39m[38;5;14m[1mMultiScanner[0m[38;5;12m (https://github.com/mitre/multiscanner) - File analysis framework written in Python that assists in evaluating a set of files by automatically running a suite of tools against them and aggregating the output.[39m
[38;5;12m- [39m[38;5;14m[1mPosh-VirusTotal[0m[38;5;12m (https://github.com/darkoperator/Posh-VirusTotal) - PowerShell interface to VirusTotal.com APIs.[39m
[38;5;12m- [39m[38;5;14m[1mcensys-python[0m[38;5;12m (https://github.com/censys/censys-python) - Python wrapper to the Censys REST API.[39m
[38;5;12m- [39m[38;5;14m[1mlibcrafter[0m[38;5;12m (https://github.com/pellegre/libcrafter) - High level C++ network packet sniffing and crafting library.[39m
[38;5;12m- [39m[38;5;14m[1mpython-dshield[0m[38;5;12m (https://github.com/rshipp/python-dshield) - Pythonic interface to the Internet Storm Center/DShield API.[39m
[38;5;12m- [39m[38;5;14m[1mpython-sandboxapi[0m[38;5;12m (https://github.com/InQuest/python-sandboxapi) - Minimal, consistent Python API for building integrations with malware sandboxes.[39m
[38;5;12m- [39m[38;5;14m[1mpython-stix2[0m[38;5;12m (https://github.com/oasis-open/cti-python-stix2) - Python APIs for serializing and de-serializing Structured Threat Information eXpression (STIX) JSON content, plus higher-level APIs for common tasks.[39m

[38;2;255;187;0m[4mSecurity Orchestration, Automation, and Response (SOAR)[0m

[38;5;12mSee also [39m[38;5;14m[1mSecurity Information and Event Management (SIEM)[0m[38;5;12m (#security-information-and-event-management-siem), and [39m[38;5;14m[1mIR management consoles[0m[38;5;12m (#ir-management-consoles).[39m

[38;5;12m- [39m[38;5;14m[1mShuffle[0m[38;5;12m (https://shuffler.io/) - Graphical generalized workflow (automation) builder for IT professionals and blue teamers.[39m

[38;2;255;187;0m[4mCloud platform security[0m

[38;5;12mSee also [39m[38;5;14m[1masecure.cloud/tools[0m[38;5;12m (https://asecure.cloud/tools/).[39m

[38;5;12m- [39m[38;5;14m[1mAaia[0m[38;5;12m (https://github.com/rams3sh/Aaia) - Helps in visualizing AWS IAM and Organizations in a graph format with help of Neo4j.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mFalco[0m[38;5;12m [39m[38;5;12m(https://falco.org/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mBehavioral[39m[38;5;12m [39m[38;5;12mactivity[39m[38;5;12m [39m[38;5;12mmonitor[39m[38;5;12m [39m[38;5;12mdesigned[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mdetect[39m[38;5;12m [39m[38;5;12manomalous[39m[38;5;12m [39m[38;5;12mactivity[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mcontainerized[39m[38;5;12m [39m[38;5;12mapplications,[39m[38;5;12m [39m[38;5;12mhosts,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mnetwork[39m[38;5;12m [39m[38;5;12mpacket[39m[38;5;12m [39m[38;5;12mflows[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mauditing[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mLinux[39m[38;5;12m [39m[38;5;12mkernel[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12menriched[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mruntime[39m[38;5;12m [39m[38;5;12mdata[39m[38;5;12m [39m[38;5;12msuch[39m[38;5;12m [39m[38;5;12mas[39m[38;5;12m [39m[38;5;12mKubernetes[39m
[38;5;12mmetrics.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mKata[0m[38;5;14m[1m [0m[38;5;14m[1mContainers[0m[38;5;12m [39m[38;5;12m(https://katacontainers.io/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mSecure[39m[38;5;12m [39m[38;5;12mcontainer[39m[38;5;12m [39m[38;5;12mruntime[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mlightweight[39m[38;5;12m [39m[38;5;12mvirtual[39m[38;5;12m [39m[38;5;12mmachines[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mfeel[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mperform[39m[38;5;12m [39m[38;5;12mlike[39m[38;5;12m [39m[38;5;12mcontainers,[39m[38;5;12m [39m[38;5;12mbut[39m[38;5;12m [39m[38;5;12mprovide[39m[38;5;12m [39m[38;5;12mstronger[39m[38;5;12m [39m[38;5;12mworkload[39m[38;5;12m [39m[38;5;12misolation[39m[38;5;12m [39m[38;5;12musing[39m[38;5;12m [39m[38;5;12mhardware[39m[38;5;12m [39m[38;5;12mvirtualization[39m[38;5;12m [39m[38;5;12mtechnology[39m[38;5;12m [39m[38;5;12mas[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m
[38;5;12msecond[39m[38;5;12m [39m[38;5;12mlayer[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mdefense.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mPrincipal[0m[38;5;14m[1m [0m[38;5;14m[1mMapper[0m[38;5;14m[1m [0m[38;5;14m[1m(PMapper)[0m[38;5;12m [39m[38;5;12m(https://github.com/nccgroup/PMapper)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mQuickly[39m[38;5;12m [39m[38;5;12mevaluate[39m[38;5;12m [39m[38;5;12mIAM[39m[38;5;12m [39m[38;5;12mpermissions[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mAWS[39m[38;5;12m [39m[38;5;12mvia[39m[38;5;12m [39m[38;5;12mscript[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mlibrary[39m[38;5;12m [39m[38;5;12mcapable[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12midentifying[39m[38;5;12m [39m[38;5;12mrisks[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mconfiguration[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mAWS[39m[38;5;12m [39m[38;5;12mIdentity[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mAccess[39m[38;5;12m [39m[38;5;12mManagement[39m[38;5;12m [39m[38;5;12m(IAM)[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12mAWS[39m
[38;5;12maccount[39m[38;5;12m [39m[38;5;12mor[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12mAWS[39m[38;5;12m [39m[38;5;12morganization.[39m
[38;5;12m- [39m[38;5;14m[1mProwler[0m[38;5;12m (https://github.com/toniblyx/prowler) - Tool based on AWS-CLI commands for Amazon Web Services account security assessment and hardening.[39m
[38;5;12m- [39m[38;5;14m[1mScout Suite[0m[38;5;12m (https://github.com/nccgroup/ScoutSuite) - Open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments.[39m
[38;5;12m- [39m[38;5;14m[1mgVisor[0m[38;5;12m (https://github.com/google/gvisor) - Application kernel, written in Go, that implements a substantial portion of the Linux system surface to provide an isolation boundary between the application and the host kernel.[39m

[38;2;255;187;0m[4mDistributed monitoring[0m

[38;5;12mSee also [39m[38;5;14m[1m§ Service and performance monitoring[0m[38;5;12m (#service-and-performance-monitoring).[39m

[38;5;12m- [39m[38;5;14m[1mCortex[0m[38;5;12m (https://cortexmetrics.io/) - Provides horizontally scalable, highly available, multi-tenant, long term storage for Prometheus.[39m
[38;5;12m- [39m[38;5;14m[1mJaeger[0m[38;5;12m (https://www.jaegertracing.io/) - Distributed tracing platform backend used for monitoring and troubleshooting microservices-based distributed systems.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mOpenTelemetry[0m[38;5;12m [39m[38;5;12m(https://opentelemetry.io/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mObservability[39m[38;5;12m [39m[38;5;12mframework[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mcloud-native[39m[38;5;12m [39m[38;5;12msoftware,[39m[38;5;12m [39m[38;5;12mcomprising[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mcollection[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mtools,[39m[38;5;12m [39m[38;5;12mAPIs,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mSDKs[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mexporting[39m[38;5;12m [39m[38;5;12mapplication[39m[38;5;12m [39m[38;5;12mperformance[39m[38;5;12m [39m[38;5;12mmetrics[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mtracing[39m[38;5;12m [39m[38;5;12mbackend[39m[38;5;12m [39m[38;5;12m(formerly[39m[38;5;12m [39m[38;5;12mmaintained[39m[38;5;12m [39m[38;5;12mby[39m
[38;5;12mthe[39m[38;5;12m [39m[38;5;12mOpenTracing[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mOpenCensus[39m[38;5;12m [39m[38;5;12mprojects).[39m
[38;5;12m- [39m[38;5;14m[1mPrometheus[0m[38;5;12m (https://prometheus.io/) - Open-source systems monitoring and alerting toolkit originally built at SoundCloud.[39m
[38;5;12m- [39m[38;5;14m[1mZipkin[0m[38;5;12m (https://zipkin.io/) - Distributed tracing system backend that helps gather timing data needed to troubleshoot latency problems in service architectures.[39m

[38;2;255;187;0m[4mKubernetes[0m

[38;5;12mSee also [39m[38;5;14m[1mKubernetes-Security.info[0m[38;5;12m (https://kubernetes-security.info/).[39m

[38;5;12m- [39m[38;5;14m[1mKubeSec[0m[38;5;12m (https://kubesec.io/) - Static analyzer of Kubernetes manifests that can be run locally, as a Kuberenetes admission controller, or as its own cloud service.[39m
[38;5;12m- [39m[38;5;14m[1mKyverno[0m[38;5;12m (https://kyverno.io/) - Policy engine designed for Kubernetes.[39m
[38;5;12m- [39m[38;5;14m[1mLinkerd[0m[38;5;12m (https://linkerd.io/) - Ultra light Kubernetes-specific service mesh that adds observability, reliability, and security to Kubernetes applications without requiring any modification of the application itself.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mManaged[0m[38;5;14m[1m [0m[38;5;14m[1mKubernetes[0m[38;5;14m[1m [0m[38;5;14m[1mInspection[0m[38;5;14m[1m [0m[38;5;14m[1mTool[0m[38;5;14m[1m [0m[38;5;14m[1m(MKIT)[0m[38;5;12m [39m[38;5;12m(https://github.com/darkbitio/mkit)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mQuery[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mvalidate[39m[38;5;12m [39m[38;5;12mseveral[39m[38;5;12m [39m[38;5;12mcommon[39m[38;5;12m [39m[38;5;12msecurity-related[39m[38;5;12m [39m[38;5;12mconfiguration[39m[38;5;12m [39m[38;5;12msettings[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mmanaged[39m[38;5;12m [39m[38;5;12mKubernetes[39m[38;5;12m [39m[38;5;12mcluster[39m[38;5;12m [39m[38;5;12mobjects[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mworkloads/resources[39m[38;5;12m [39m[38;5;12mrunning[39m[38;5;12m [39m[38;5;12minside[39m
[38;5;12mthe[39m[38;5;12m [39m[38;5;12mcluster.[39m
[38;5;12m- [39m[38;5;14m[1mPolaris[0m[38;5;12m (https://polaris.docs.fairwinds.com/) - Validates Kubernetes best practices by running tests against code commits, a Kubernetes admission request, or live resources already running in a cluster. [39m
[38;5;12m- [39m[38;5;14m[1mSealed Secrets[0m[38;5;12m (https://github.com/bitnami-labs/sealed-secrets) - Kubernetes controller and tool for one-way encrypted Secrets.[39m
[38;5;12m- [39m[38;5;14m[1mcertificate-expiry-monitor[0m[38;5;12m (https://github.com/muxinc/certificate-expiry-monitor) - Utility that exposes the expiry of TLS certificates as Prometheus metrics.[39m
[38;5;12m- [39m[38;5;14m[1mk-rail[0m[38;5;12m (https://github.com/cruise-automation/k-rail) - Workload policy enforcement tool for Kubernetes.[39m
[38;5;12m- [39m[38;5;14m[1mkube-forensics[0m[38;5;12m (https://github.com/keikoproj/kube-forensics) - Allows a cluster administrator to dump the current state of a running pod and all its containers so that security professionals can perform off-line forensic analysis.[39m
[38;5;12m- [39m[38;5;14m[1mkube-hunter[0m[38;5;12m (https://kube-hunter.aquasec.com/) - Open-source tool that runs a set of tests ("hunters") for security issues in Kubernetes clusters from either outside ("attacker's view") or inside a cluster.[39m
[38;5;12m- [39m[38;5;14m[1mkubernetes-event-exporter[0m[38;5;12m (https://github.com/opsgenie/kubernetes-event-exporter) - Allows exporting the often missed Kubernetes events to various outputs so that they can be used for observability or alerting purposes.[39m

[38;2;255;187;0m[4mService meshes[0m

[38;5;12mSee also [39m[38;5;14m[1mServiceMesh.es[0m[38;5;12m (https://servicemesh.es/).[39m

[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mConsul[0m[38;5;12m [39m[38;5;12m(https://consul.io/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mSolution[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mconnect[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mconfigure[39m[38;5;12m [39m[38;5;12mapplications[39m[38;5;12m [39m[38;5;12macross[39m[38;5;12m [39m[38;5;12mdynamic,[39m[38;5;12m [39m[38;5;12mdistributed[39m[38;5;12m [39m[38;5;12minfrastructure[39m[38;5;12m [39m[38;5;12mand,[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mConsul[39m[38;5;12m [39m[38;5;12mConnect,[39m[38;5;12m [39m[38;5;12menabling[39m[38;5;12m [39m[38;5;12msecure[39m[38;5;12m [39m[38;5;12mservice-to-service[39m[38;5;12m [39m[38;5;12mcommunication[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mautomatic[39m[38;5;12m [39m[38;5;12mTLS[39m[38;5;12m [39m[38;5;12mencryption[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m
[38;5;12midentity-based[39m[38;5;12m [39m[38;5;12mauthorization.[39m
[38;5;12m- [39m[38;5;14m[1mIstio[0m[38;5;12m (https://istio.io/) - Open platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.[39m

[38;2;255;187;0m[4mCommunications security (COMSEC)[0m

[38;5;12mSee also [39m[38;5;14m[1mTransport-layer defenses[0m[38;5;12m (#transport-layer-defenses).[39m

[38;5;12m- [39m[38;5;14m[1mGPG Sync[0m[38;5;12m (https://github.com/firstlookmedia/gpgsync) - Centralize and automate OpenPGP public key distribution, revocation, and updates amongst all members of an organization or team.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mGeneva[0m[38;5;14m[1m [0m[38;5;14m[1m(Genetic[0m[38;5;14m[1m [0m[38;5;14m[1mEvasion)[0m[38;5;12m [39m[38;5;12m(https://censorship.ai/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mNovel[39m[38;5;12m [39m[38;5;12mexperimental[39m[38;5;12m [39m[38;5;12mgenetic[39m[38;5;12m [39m[38;5;12malgorithm[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mevolves[39m[38;5;12m [39m[38;5;12mpacket-manipulation-based[39m[38;5;12m [39m[38;5;12mcensorship[39m[38;5;12m [39m[38;5;12mevasion[39m[38;5;12m [39m[38;5;12mstrategies[39m[38;5;12m [39m[38;5;12magainst[39m[38;5;12m [39m[38;5;12mnation-state[39m[38;5;12m [39m[38;5;12mlevel[39m[38;5;12m [39m[38;5;12mcensors[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mincrease[39m[38;5;12m [39m[38;5;12mavailability[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12motherwise[39m[38;5;12m [39m
[38;5;12mblocked[39m[38;5;12m [39m[38;5;12mcontent.[39m
[38;5;12m- [39m[38;5;14m[1mGlobaLeaks[0m[38;5;12m (https://www.globaleaks.org/) - Free, open source software enabling anyone to easily set up and maintain a secure whistleblowing platform.[39m
[38;5;12m- [39m[38;5;14m[1mSecureDrop[0m[38;5;12m (https://securedrop.org/) - Open source whistleblower submission system that media organizations and NGOs can install to securely accept documents from anonymous sources.[39m
[38;5;12m- [39m[38;5;14m[1mTeleport[0m[38;5;12m (https://goteleport.com/) - Allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments.[39m

[38;2;255;187;0m[4mDevSecOps[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-devsecops[0m[38;5;12m (https://github.com/devsecops/awesome-devsecops).[39m

[38;5;12m- [39m[38;5;14m[1mBane[0m[38;5;12m (https://github.com/genuinetools/bane) - Custom and better AppArmor profile generator for Docker containers.[39m
[38;5;12m- [39m[38;5;14m[1mBlackBox[0m[38;5;12m (https://github.com/StackExchange/blackbox) - Safely store secrets in Git/Mercurial/Subversion by encrypting them "at rest" using GnuPG.[39m
[38;5;12m- [39m[38;5;14m[1mCheckov[0m[38;5;12m (https://www.checkov.io/) - Static analysis for Terraform (infrastructure as code) to help detect CIS policy violations and prevent cloud security misconfiguration.[39m
[38;5;12m- [39m[38;5;14m[1mCilium[0m[38;5;12m (https://cilium.io/) - Open source software for transparently securing the network connectivity between application services deployed using Linux container management platforms like Docker and Kubernetes.[39m
[38;5;12m- [39m[38;5;14m[1mClair[0m[38;5;12m (https://github.com/coreos/clair) - Static analysis tool to probe for vulnerabilities introduced via application container (e.g., Docker) images.[39m
[38;5;12m- [39m[38;5;14m[1mCodeQL[0m[38;5;12m (https://securitylab.github.com/tools/codeql) - Discover vulnerabilities across a codebase by performing queries against code as though it were data.[39m
[38;5;12m- [39m[38;5;14m[1mDefectDojo[0m[38;5;12m (https://www.defectdojo.org/) - Application vulnerability management tool built for DevOps and continuous security integration.[39m
[38;5;12m- [39m[38;5;14m[1mGauntlt[0m[38;5;12m (http://gauntlt.org/) - Pentest applications during routine continuous integration build pipelines.[39m
[38;5;12m- [39m[38;5;14m[1mGit Secrets[0m[38;5;12m (https://github.com/awslabs/git-secrets) - Prevents you from committing passwords and other sensitive information to a git repository.[39m
[38;5;12m- [39m[38;5;14m[1mSOPS[0m[38;5;12m (https://github.com/mozilla/sops) - Editor of encrypted files that supports YAML, JSON, ENV, INI and binary formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, and PGP.[39m
[38;5;12m- [39m[38;5;14m[1mSnyk[0m[38;5;12m (https://snyk.io/) - Finds and fixes vulnerabilities and license violations in open source dependencies and container images.[39m
[38;5;12m- [39m[38;5;14m[1mSonarQube[0m[38;5;12m (https://sonarqube.org) - Continuous inspection tool that provides detailed reports during automated testing and alerts on newly introduced security vulnerabilities.[39m
[38;5;12m- [39m[38;5;14m[1mTrivy[0m[38;5;12m (https://github.com/aquasecurity/trivy) - Simple and comprehensive vulnerability scanner for containers and other artifacts, suitable for use in continuous integration pipelines.[39m
[38;5;12m- [39m[38;5;14m[1mVault[0m[38;5;12m (https://www.vaultproject.io/) - Tool for securely accessing secrets such as API keys, passwords, or certificates through a unified interface.[39m
[38;5;12m- [39m[38;5;14m[1mgit-crypt[0m[38;5;12m (https://www.agwa.name/projects/git-crypt/) - Transparent file encryption in git; files which you choose to protect are encrypted when committed, and decrypted when checked out.[39m
[38;5;12m- [39m[38;5;14m[1mhelm-secrets[0m[38;5;12m (https://github.com/jkroepke/helm-secrets) - Helm plugin that helps manage secrets with Git workflow and stores them anywhere, backed by SOPS.[39m
[38;5;12m- [39m[38;5;14m[1mterrascan[0m[38;5;12m (https://runterrascan.io/) - Static code analyzer for Infrastructure as Code tools that helps detect compliance and security violations to mitigate risk before provisioning cloud native resources.[39m
[38;5;12m- [39m[38;5;14m[1mtfsec[0m[38;5;12m (https://aquasecurity.github.io/tfsec/) - Static analysis security scanner for your Terraform code designed to run locally and in CI pipelines.[39m

[38;2;255;187;0m[4mApplication or Binary Hardening[0m

[38;5;12m- [39m[38;5;14m[1mDynInst[0m[38;5;12m (https://dyninst.org/dyninst) - Tools for binary instrumentation, analysis, and modification, useful for binary patching.[39m
[38;5;12m- [39m[38;5;14m[1mDynamoRIO[0m[38;5;12m (https://dynamorio.org/) - Runtime code manipulation system that supports code transformations on any part of a program, while it executes, implemented as a process-level virtual machine.[39m
[38;5;12m- [39m[38;5;14m[1mEgalito[0m[38;5;12m (https://egalito.org/) - Binary recompiler and instrumentation framework that can fully disassemble, transform, and regenerate ordinary Linux binaries designed for binary hardening and security research.[39m
[38;5;12m- [39m[38;5;14m[1mValgrind[0m[38;5;12m (https://www.valgrind.org/) - Instrumentation framework for building dynamic analysis tools.[39m

[38;2;255;187;0m[4mCompliance testing and reporting[0m

[38;5;12m- [39m[38;5;14m[1mChef InSpec[0m[38;5;12m (https://www.chef.io/products/chef-inspec) - Language for describing security and compliance rules, which become automated tests that can be run against IT infrastructures to discover and report on non-compliance.[39m
[38;5;12m- [39m[38;5;14m[1mOpenSCAP Base[0m[38;5;12m (https://www.open-scap.org/tools/openscap-base/) - Both a library and a command line tool ([39m[48;5;235m[38;5;249moscap[49m[39m[38;5;12m) used to evaluate a system against SCAP baseline profiles to report on the security posture of the scanned system(s). [39m

[38;2;255;187;0m[4mDependency confusion[0m

[38;5;12mSee also [39m[38;5;14m[1m§ Supply chain security[0m[38;5;12m (#supply-chain-security).[39m

[38;5;12m- [39m[38;5;14m[1mDependency Combobulator[0m[38;5;12m (https://github.com/apiiro/combobulator) - Open source, modular and extensible framework to detect and prevent dependency confusion leakage and potential attacks.[39m
[38;5;12m- [39m[38;5;14m[1mConfusion checker[0m[38;5;12m (https://github.com/sonatype-nexus-community/repo-diff) - Script to check if you have artifacts containing the same name between your repositories.[39m
[38;5;12m- [39m[38;5;14m[1msnync[0m[38;5;12m (https://github.com/snyk-labs/snync) - Prevent and detect if you're vulnerable to dependency confusion supply chain security attacks.[39m

[38;2;255;187;0m[4mFuzzing[0m

[38;5;12mSee also [39m[38;5;14m[1mAwesome-Fuzzing[0m[38;5;12m (https://github.com/secfigo/Awesome-Fuzzing).[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAtheris[0m[38;5;12m (https://pypi.org/project/atheris/) - Coverage-guided Python fuzzing engine based off of libFuzzer that supports fuzzing of Python code but also native extensions written for CPython.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFuzzBench[0m[38;5;12m (https://google.github.io/fuzzbench/) - Free service that evaluates fuzzers on a wide variety of real-world benchmarks, at Google scale.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOneFuzz[0m[38;5;12m (https://github.com/microsoft/onefuzz) - Self-hosted Fuzzing-as-a-Service (FaaS) platform.[39m

[38;2;255;187;0m[4mPolicy enforcement[0m

[38;5;12m- [39m[38;5;14m[1mAllStar[0m[38;5;12m (https://github.com/ossf/allstar) - GitHub App installed on organizations or repositories to set and enforce security policies.[39m
[38;5;12m- [39m[38;5;14m[1mConftest[0m[38;5;12m (https://conftest.dev/) - Utility to help you write tests against structured configuration data.[39m
[38;5;12m- [39m[38;5;14m[1mOpen Policy Agent (OPA)[0m[38;5;12m (https://www.openpolicyagent.org/) - Unified toolset and framework for policy across the cloud native stack.[39m
[38;5;12m- [39m[38;5;14m[1mRegula[0m[38;5;12m (https://regula.dev/) - Checks infrastructure as code templates (Terraform, CloudFormation, K8s manifests) for AWS, Azure, Google Cloud, and Kubernetes security and compliance using Open Policy Agent/Rego.[39m
[38;5;12m- [39m[38;5;14m[1mTang[0m[38;5;12m (https://github.com/latchset/tang) - Server for binding data to network presence; provides data to clients only when they are on a certain (secured) network.[39m

[38;2;255;187;0m[4mSupply chain security[0m

[38;5;12mSee also [39m[38;5;14m[1m§ Dependency confusion[0m[38;5;12m (#dependency-confusion).[39m

[38;5;12m- [39m[38;5;14m[1mGrafeas[0m[38;5;12m (https://grafeas.io/) - Open artifact metadata API to audit and govern your software supply chain.[39m
[38;5;12m- [39m[38;5;14m[1mHelm GPG (GnuPG) Plugin[0m[38;5;12m (https://github.com/technosophos/helm-gpg) - Chart signing and verification with GnuPG for Helm.[39m
[38;5;12m- [39m[38;5;14m[1mNotary[0m[38;5;12m (https://github.com/theupdateframework/notary) - Aims to make the internet more secure by making it easy for people to publish and verify content.[39m
[38;5;12m- [39m[38;5;14m[1min-toto[0m[38;5;12m (https://in-toto.io/) - Framework to secure the integrity of software supply chains.[39m

[38;2;255;187;0m[4mHoneypots[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-honeypots[0m[38;5;12m (https://github.com/paralax/awesome-honeypots).[39m

[38;5;12m- [39m[38;5;14m[1mCanaryTokens[0m[38;5;12m (https://github.com/thinkst/canarytokens) - Self-hostable honeytoken generator and reporting dashboard; demo version available at [39m[38;5;14m[1mCanaryTokens.org[0m[38;5;12m (https://canarytokens.org/).[39m
[38;5;12m- [39m[38;5;14m[1mKushtaka[0m[38;5;12m (https://kushtaka.org) - Sustainable all-in-one honeypot and honeytoken orchestrator for under-resourced blue teams.[39m
[38;5;12m- [39m[38;5;14m[1mManuka[0m[38;5;12m (https://github.com/spaceraccoon/manuka) - Open-sources intelligence (OSINT) honeypot that monitors reconnaissance attempts by threat actors and generates actionable intelligence for Blue Teamers.[39m

[38;2;255;187;0m[4mTarpits[0m

[38;5;12m- [39m[38;5;14m[1mEndlessh[0m[38;5;12m (https://github.com/skeeto/endlessh) - SSH tarpit that slowly sends an endless banner.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mLaBrea[0m[38;5;12m [39m[38;5;12m(http://labrea.sourceforge.net/labrea-info.html)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mProgram[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12manswers[39m[38;5;12m [39m[38;5;12mARP[39m[38;5;12m [39m[38;5;12mrequests[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12munused[39m[38;5;12m [39m[38;5;12mIP[39m[38;5;12m [39m[38;5;12mspace,[39m[38;5;12m [39m[38;5;12mcreating[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mappearance[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mfake[39m[38;5;12m [39m[38;5;12mmachines[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12manswer[39m[38;5;12m [39m[38;5;12mfurther[39m[38;5;12m [39m[38;5;12mrequests[39m[38;5;12m [39m[38;5;12mvery[39m[38;5;12m [39m[38;5;12mslowly[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12morder[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mslow[39m[38;5;12m [39m[38;5;12mdown[39m[38;5;12m [39m[38;5;12mscanners,[39m[38;5;12m [39m[38;5;12mworms,[39m[38;5;12m [39m
[38;5;12metcetera.[39m

[38;2;255;187;0m[4mHost-based tools[0m

[38;5;12m- [39m[38;5;14m[1mArtillery[0m[38;5;12m (https://github.com/BinaryDefense/artillery) - Combination honeypot, filesystem monitor, and alerting system designed to protect Linux and Windows operating systems.[39m
[38;5;12m- [39m[38;5;14m[1mCrowd Inspect[0m[38;5;12m (https://www.crowdstrike.com/resources/community-tools/crowdinspect-tool/) - Free tool for Windows systems aimed to alert you to the presence of malware that may be communicating over the network.[39m
[38;5;12m- [39m[38;5;14m[1mFail2ban[0m[38;5;12m (https://www.fail2ban.org/) - Intrusion prevention software framework that protects computer servers from brute-force attacks.[39m
[38;5;12m- [39m[38;5;14m[1mOpen Source HIDS SECurity (OSSEC)[0m[38;5;12m (https://www.ossec.net/) - Fully open source and free, feature-rich, Host-based Instrusion Detection System (HIDS).[39m
[38;5;12m- [39m[38;5;14m[1mRootkit Hunter (rkhunter)[0m[38;5;12m (http://rkhunter.sourceforge.net/) - POSIX-compliant Bash script that scans a host for various signs of malware.[39m
[38;5;12m- [39m[38;5;14m[1mShufflecake[0m[38;5;12m (https://shufflecake.net/) - Plausible deniability for multiple hidden filesystems on Linux.[39m
[38;5;12m- [39m[38;5;14m[1mUSB Keystroke Injection Protection[0m[38;5;12m (https://github.com/google/ukip) - Daemon for blocking USB keystroke injection devices on Linux systems.[39m
[38;5;12m- [39m[38;5;14m[1mchkrootkit[0m[38;5;12m (http://chkrootkit.org/) - Locally checks for signs of a rootkit on GNU/Linux systems.[39m

[38;2;255;187;0m[4mSandboxes[0m

[38;5;12m- [39m[38;5;14m[1mBubblewrap[0m[38;5;12m (https://github.com/containers/bubblewrap) - Sandboxing tool for use by unprivileged Linux users capable of restricting access to parts of the operating system or user data.[39m
[38;5;12m- [39m[38;5;14m[1mDangerzone[0m[38;5;12m (https://dangerzone.rocks/) - Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.[39m
[38;5;12m- [39m[38;5;14m[1mFirejail[0m[38;5;12m (https://firejail.wordpress.com/) - SUID program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf.[39m

[38;2;255;187;0m[4mIdentity and AuthN/AuthZ[0m

[38;5;12m- [39m[38;5;14m[1mGluu Server[0m[38;5;12m (https://gluu.org/) - Central authentication and authorization for Web and mobile applications with a Free and Open Source Software cloud-native community distribution.[39m

[38;2;255;187;0m[4mIncident Response tools[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-incident-response[0m[38;5;12m (https://github.com/meirwah/awesome-incident-response).[39m

[38;5;12m- [39m[38;5;14m[1mLogonTracer[0m[38;5;12m (https://github.com/JPCERTCC/LogonTracer) - Investigate malicious Windows logon by visualizing and analyzing Windows event log.[39m
[38;5;12m- [39m[38;5;14m[1mVolatility[0m[38;5;12m (https://www.volatilityfoundation.org/) - Advanced memory forensics framework.[39m
[38;5;12m- [39m[38;5;14m[1maws_ir[0m[38;5;12m (https://github.com/ThreatResponse/aws_ir) - Automates your incident response with zero security preparedness assumptions.[39m

[38;2;255;187;0m[4mIR management consoles[0m

[38;5;12mSee also [39m[38;5;14m[1mSecurity Orchestration, Automation, and Response (SOAR)[0m[38;5;12m (#security-orchestration-automation-and-response-soar).[39m

[38;5;12m- [39m[38;5;14m[1mCIRTKit[0m[38;5;12m (https://github.com/opensourcesec/CIRTKit) - Scriptable Digital Forensics and Incident Response (DFIR) toolkit built on Viper.[39m
[38;5;12m- [39m[38;5;14m[1mFast Incident Response (FIR)[0m[38;5;12m (https://github.com/certsocietegenerale/FIR) - Cybersecurity incident management platform allowing for easy creation, tracking, and reporting of cybersecurity incidents.[39m
[38;5;12m- [39m[38;5;14m[1mRekall[0m[38;5;12m (http://www.rekall-forensic.com/) - Advanced forensic and incident response framework.[39m
[38;5;12m- [39m[38;5;14m[1mTheHive[0m[38;5;12m (https://thehive-project.org/) - Scalable, free Security Incident Response Platform designed to make life easier for SOCs, CSIRTs, and CERTs, featuring tight integration with MISP.[39m
[38;5;12m- [39m[38;5;14m[1mthreat_note[0m[38;5;12m (https://github.com/defpoint/threat_note) - Web application built by Defense Point Security to allow security researchers the ability to add and retrieve indicators related to their research.[39m

[38;2;255;187;0m[4mEvidence collection[0m

[38;5;12m- [39m[38;5;14m[1mAutoMacTC[0m[38;5;12m (https://github.com/CrowdStrike/automactc) - Modular, automated forensic triage collection framework designed to access various forensic artifacts on macOS, parse them, and present them in formats viable for analysis.[39m
[38;5;12m- [39m[38;5;14m[1mOSXAuditor[0m[38;5;12m (https://github.com/jipegit/OSXAuditor) - Free macOS computer forensics tool.[39m
[38;5;12m- [39m[38;5;14m[1mOSXCollector[0m[38;5;12m (https://github.com/Yelp/osxcollector) - Forensic evidence collection & analysis toolkit for macOS.[39m
[38;5;12m- [39m[38;5;14m[1mir-rescue[0m[38;5;12m (https://github.com/diogo-fernan/ir-rescue) - Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.[39m
[38;5;12m- [39m[38;5;14m[1mMargarita Shotgun[0m[38;5;12m (https://github.com/ThreatResponse/margaritashotgun) - Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mUntitled[0m[38;5;14m[1m [0m[38;5;14m[1mGoose[0m[38;5;14m[1m [0m[38;5;14m[1mTool[0m[38;5;12m [39m[38;5;12m(https://github.com/cisagov/untitledgoosetool)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mAssists[39m[38;5;12m [39m[38;5;12mincident[39m[38;5;12m [39m[38;5;12mresponse[39m[38;5;12m [39m[38;5;12mteams[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mexporting[39m[38;5;12m [39m[38;5;12mcloud[39m[38;5;12m [39m[38;5;12martifacts[39m[38;5;12m [39m[38;5;12mfrom[39m[38;5;12m [39m[38;5;12mAzure/AzureAD/M365[39m[38;5;12m [39m[38;5;12menvironments[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12morder[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mrun[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mfull[39m[38;5;12m [39m[38;5;12minvestigation[39m[38;5;12m [39m[38;5;12mdespite[39m[38;5;12m [39m[38;5;12mlacking[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mlogs[39m[38;5;12m [39m
[38;5;12mingested[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mSIEM.[39m

[38;2;255;187;0m[4mNetwork perimeter defenses[0m

[38;5;12m- [39m[38;5;14m[1mGatekeeper[0m[38;5;12m (https://github.com/AltraMayor/gatekeeper) - First open source Distributed Denial of Service (DDoS) protection system.[39m
[38;5;12m- [39m[38;5;14m[1mfwknop[0m[38;5;12m (https://www.cipherdyne.org/fwknop/) - Protects ports via Single Packet Authorization in your firewall.[39m
[38;5;12m- [39m[38;5;14m[1mssh-audit[0m[38;5;12m (https://github.com/jtesta/ssh-audit) - Simple tool that makes quick recommendations for improving an SSH server's security posture.[39m

[38;2;255;187;0m[4mFirewall appliances or distributions[0m

[38;5;12mSee also [39m[38;5;14m[1mWikipedia: List of router and firewall distributions[0m[38;5;12m (https://en.wikipedia.org/wiki/List_of_router_and_firewall_distributions).[39m

[38;5;12m- [39m[38;5;14m[1mIPFire[0m[38;5;12m (https://www.ipfire.org/) - Hardened GNU/Linux based router and firewall distribution forked from IPCop.[39m
[38;5;12m- [39m[38;5;14m[1mOPNsense[0m[38;5;12m (https://opnsense.org/) - Hardened FreeBSD based firewall and routing platform forked from pfSense.[39m
[38;5;12m- [39m[38;5;14m[1mpfSense[0m[38;5;12m (https://www.pfsense.org/) - FreeBSD firewall and router distribution forked from m0n0wall.[39m

[38;2;255;187;0m[4mOperating System distributions[0m

[38;5;12m- [39m[38;5;14m[1mComputer Aided Investigative Environment (CAINE)[0m[38;5;12m (https://caine-live.net/) - Italian GNU/Linux live distribution that pre-packages numerous digital forensics and evidence collection tools.[39m
[38;5;12m- [39m[38;5;14m[1mSecurity Onion[0m[38;5;12m (https://securityonion.net/) - Free and open source GNU/Linux distribution for intrusion detection, enterprise security monitoring, and log management.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mQubes[0m[38;5;14m[1m [0m[38;5;14m[1mOS[0m[38;5;12m [39m[38;5;12m(https://qubes-os.org/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mDesktop[39m[38;5;12m [39m[38;5;12menvironment[39m[38;5;12m [39m[38;5;12mbuilt[39m[38;5;12m [39m[38;5;12matop[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mXen[39m[38;5;12m [39m[38;5;12mhypervisor[39m[38;5;12m [39m[38;5;12mproject[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mruns[39m[38;5;12m [39m[38;5;12meach[39m[38;5;12m [39m[38;5;12mend-user[39m[38;5;12m [39m[38;5;12mprogram[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mits[39m[38;5;12m [39m[38;5;12mown[39m[38;5;12m [39m[38;5;12mvirtual[39m[38;5;12m [39m[38;5;12mmachine[39m[38;5;12m [39m[38;5;12mintended[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mprovide[39m[38;5;12m [39m[38;5;12mstrict[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m[38;5;12mcontrols[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mconstrain[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mreach[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12many[39m[38;5;12m [39m
[38;5;12msuccessful[39m[38;5;12m [39m[38;5;12mmalware[39m[38;5;12m [39m[38;5;12mexploit.[39m

[38;2;255;187;0m[4mPhishing awareness and reporting[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-pentest § Social Engineering Tools[0m[38;5;12m (https://github.com/fabacab/awesome-pentest#social-engineering-tools).[39m

[38;5;12m- [39m[38;5;14m[1mCertSpotter[0m[38;5;12m (https://github.com/SSLMate/certspotter) - Certificate Transparency log monitor from SSLMate that alerts you when a SSL/TLS certificate is issued for one of your domains.[39m
[38;5;12m- [39m[38;5;14m[1mGophish[0m[38;5;12m (https://getgophish.com/) - Powerful, open-source phishing framework that makes it easy to test your organization's exposure to phishing.[39m
[38;5;12m- [39m[38;5;14m[1mKing Phisher[0m[38;5;12m (https://github.com/securestate/king-phisher) - Tool for testing and promoting user awareness by simulating real world phishing attacks.[39m
[38;5;12m- [39m[38;5;14m[1mNotifySecurity[0m[38;5;12m (https://github.com/certsocietegenerale/NotifySecurity) - Outlook add-in used to help your users to report suspicious e-mails to security teams.[39m
[38;5;12m- [39m[38;5;14m[1mPhishing Intelligence Engine (PIE)[0m[38;5;12m (https://github.com/LogRhythm-Labs/PIE) - Framework that will assist with the detection and response to phishing attacks.[39m
[38;5;12m- [39m[38;5;14m[1mSwordphish[0m[38;5;12m (https://github.com/certsocietegenerale/swordphish-awareness) - Platform allowing to create and manage (fake) phishing campaigns intended to train people in identifying suspicious mails. [39m
[38;5;12m- [39m[38;5;14m[1mmailspoof[0m[38;5;12m (https://github.com/serain/mailspoof) - Scans SPF and DMARC records for issues that could allow email spoofing.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mphishing_catcher[0m[38;5;12m [39m[38;5;12m(https://github.com/x0rz/phishing_catcher)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mConfigurable[39m[38;5;12m [39m[38;5;12mscript[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mwatch[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12missuances[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12msuspicious[39m[38;5;12m [39m[38;5;12mTLS[39m[38;5;12m [39m[38;5;12mcertificates[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mdomain[39m[38;5;12m [39m[38;5;12mname[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mCertificate[39m[38;5;12m [39m[38;5;12mTransparency[39m[38;5;12m [39m[38;5;12mLog[39m[38;5;12m [39m[38;5;12m(CTL)[39m[38;5;12m [39m[38;5;12musing[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;14m[1mCertStream[0m[38;5;12m [39m
[38;5;12m(https://certstream.calidog.io/)[39m[38;5;12m [39m[38;5;12mservice.[39m

[38;2;255;187;0m[4mPreparedness training and wargaming[0m

[38;5;12m(Also known as [39m[48;2;30;30;40m[38;5;13m[3madversary emulation[0m[38;5;12m, [39m[48;2;30;30;40m[38;5;13m[3mthreat simulation[0m[38;5;12m, or similar.)[39m

[38;5;12m- [39m[38;5;14m[1mAPTSimulator[0m[38;5;12m (https://github.com/NextronSystems/APTSimulator) - Toolset to make a system look as if it was the victim of an APT attack.[39m
[38;5;12m- [39m[38;5;14m[1mAtomic Red Team[0m[38;5;12m (https://atomicredteam.io/) - Library of simple, automatable tests to execute for testing security controls.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mBadBlood[0m[38;5;12m [39m[38;5;12m(https://www.secframe.com/badblood/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mFills[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mtest[39m[38;5;12m [39m[38;5;12m(non-production)[39m[38;5;12m [39m[38;5;12mWindows[39m[38;5;12m [39m[38;5;12mDomain[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mdata[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12menables[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m[38;5;12manalysts[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mengineers[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mpractice[39m[38;5;12m [39m[38;5;12musing[39m[38;5;12m [39m[38;5;12mtools[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mgain[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12munderstanding[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mprescribe[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12msecuring[39m[38;5;12m [39m[38;5;12mActive[39m[38;5;12m [39m
[38;5;12mDirectory.[39m
[38;5;12m- [39m[38;5;14m[1mCaldera[0m[38;5;12m (https://caldera.mitre.org/) - Scalable, automated, and extensible adversary emulation platform developed by MITRE.[39m
[38;5;12m- [39m[38;5;14m[1mDrool[0m[38;5;12m (https://www.dns-oarc.net/tools/drool) - Replay DNS traffic from packet capture files and send it to a specified server, such as for simulating DDoS attacks on the DNS and measuring normal DNS querying.[39m
[38;5;12m- [39m[38;5;14m[1mDumpsterFire[0m[38;5;12m (https://github.com/TryCatchHCF/DumpsterFire) - Modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events for Blue Team drills and sensor/alert mapping.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mInfection[0m[38;5;14m[1m [0m[38;5;14m[1mMonkey[0m[38;5;12m [39m[38;5;12m(https://www.guardicore.com/infectionmonkey/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mOpen-source[39m[38;5;12m [39m[38;5;12mbreach[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mattack[39m[38;5;12m [39m[38;5;12msimulation[39m[38;5;12m [39m[38;5;12m(BAS)[39m[38;5;12m [39m[38;5;12mplatform[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mhelps[39m[38;5;12m [39m[38;5;12myou[39m[38;5;12m [39m[38;5;12mvalidate[39m[38;5;12m [39m[38;5;12mexisting[39m[38;5;12m [39m[38;5;12mcontrols[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12midentify[39m[38;5;12m [39m[38;5;12mhow[39m[38;5;12m [39m[38;5;12mattackers[39m[38;5;12m [39m[38;5;12mmight[39m[38;5;12m [39m[38;5;12mexploit[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12mcurrent[39m[38;5;12m [39m[38;5;12mnetwork[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m
[38;5;12mgaps.[39m
[38;5;12m- [39m[38;5;14m[1mMetta[0m[38;5;12m (https://github.com/uber-common/metta) - Automated information security preparedness tool to do adversarial simulation.[39m
[38;5;12m- [39m[38;5;14m[1mNetwork Flight Simulator ([0m[48;5;235m[38;5;249m[1mflightsim[0m[38;5;14m[1m)[0m[38;5;12m (https://github.com/alphasoc/flightsim) - Utility to generate malicious network traffic and help security teams evaluate security controls and audit their network visibility.[39m
[38;5;12m- [39m[38;5;14m[1mRedHunt OS[0m[38;5;12m (https://github.com/redhuntlabs/RedHunt-OS) - Ubuntu-based Open Virtual Appliance ([39m[48;5;235m[38;5;249m.ova[49m[39m[38;5;12m) preconfigured with several threat emulation tools as well as a defender's toolkit.[39m
[38;5;12m- [39m[38;5;14m[1mStratus Red Team[0m[38;5;12m (https://stratus-red-team.cloud/) - Emulate offensive attack techniques in a granular and self-contained manner against a cloud environment; think "Atomic Red Team™ for the cloud."[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mtcpreplay[0m[38;5;12m [39m[38;5;12m(https://tcpreplay.appneta.com/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mSuite[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mfree[39m[38;5;12m [39m[38;5;12mOpen[39m[38;5;12m [39m[38;5;12mSource[39m[38;5;12m [39m[38;5;12mutilities[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mediting[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mreplaying[39m[38;5;12m [39m[38;5;12mpreviously[39m[38;5;12m [39m[38;5;12mcaptured[39m[38;5;12m [39m[38;5;12mnetwork[39m[38;5;12m [39m[38;5;12mtraffic[39m[38;5;12m [39m[38;5;12moriginally[39m[38;5;12m [39m[38;5;12mdesigned[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mreplay[39m[38;5;12m [39m[38;5;12mmalicious[39m[38;5;12m [39m[38;5;12mtraffic[39m[38;5;12m [39m[38;5;12mpatterns[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mIntrusion[39m[38;5;12m [39m[38;5;12mDetection/Prevention[39m[38;5;12m [39m
[38;5;12mSystems.[39m

[38;2;255;187;0m[4mPost-engagement analysis and reporting[0m

[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mRedEye[0m[38;5;12m [39m[38;5;12m(https://cisagov.github.io/RedEye/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mAnalytic[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12massist[39m[38;5;12m [39m[38;5;12mboth[39m[38;5;12m [39m[38;5;12mRed[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mBlue[39m[38;5;12m [39m[38;5;12mteams[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mvisualizing[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mreporting[39m[38;5;12m [39m[38;5;12mcommand[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mcontrol[39m[38;5;12m [39m[38;5;12mactivities,[39m[38;5;12m [39m[38;5;12mreplay[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mdemonstrate[39m[38;5;12m [39m[38;5;12mattack[39m[38;5;12m [39m[38;5;12mpaths,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mmore[39m[38;5;12m [39m[38;5;12mclearly[39m[38;5;12m [39m[38;5;12mcommunicate[39m[38;5;12m [39m[38;5;12mremediation[39m[38;5;12m [39m
[38;5;12mrecommendations[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mstakeholders.[39m

[38;2;255;187;0m[4mSecurity configurations[0m

[38;5;12m(Also known as [39m[48;2;30;30;40m[38;5;13m[3msecure-by-default baselines[0m[38;5;12m and [39m[48;2;30;30;40m[38;5;13m[3mimplemented best practices[0m[38;5;12m.)[39m

[38;5;12m- [39m[38;5;14m[1mBunkerized-nginx[0m[38;5;12m (https://github.com/bunkerity/bunkerized-nginx) - Docker image of an NginX configuration and scripts implementing many defensive techniques for Web sites.[39m

[38;2;255;187;0m[4mSecurity monitoring[0m

[38;5;12m- [39m[38;5;14m[1mCrossfeed[0m[38;5;12m (https://docs.crossfeed.cyber.dhs.gov/) - Continuously enumerates and monitors an organization’s public-facing attack surface in order to discover assets and flag potential security flaws.[39m
[38;5;12m- [39m[38;5;14m[1mStarbase[0m[38;5;12m (https://github.com/JupiterOne/starbase) - Collects assets and relationships from services and systems into an intuitive graph view to offer graph-based security analysis for everyone.[39m

[38;2;255;187;0m[4mEndpoint Detection and Response (EDR)[0m

[38;5;12m- [39m[38;5;14m[1mWazuh[0m[38;5;12m (https://wazuh.com/) - Open source, multiplatform agent-based security monitoring based on a fork of OSSEC HIDS.[39m

[38;2;255;187;0m[4mNetwork Security Monitoring (NSM)[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-pcaptools[0m[38;5;12m (https://github.com/caesar0301/awesome-pcaptools).[39m

[38;5;12m- [39m[38;5;14m[1mArkime[0m[38;5;12m (https://github.com/arkime/arkime) - Augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access.[39m
[38;5;12m- [39m[38;5;14m[1mChopShop[0m[38;5;12m (https://github.com/MITRECND/chopshop) - Framework to aid analysts in the creation and execution of pynids-based decoders and detectors of APT tradecraft.[39m
[38;5;12m- [39m[38;5;14m[1mMaltrail[0m[38;5;12m (https://github.com/stamparm/maltrail) - Malicious network traffic detection system.[39m
[38;5;12m- [39m[38;5;14m[1mOwlH[0m[38;5;12m (https://www.owlh.net/) - Helps manage network IDS at scale by visualizing Suricata, Zeek, and Moloch life cycles.[39m
[38;5;12m- [39m[38;5;14m[1mReal Intelligence Threat Analysis (RITA)[0m[38;5;12m (https://github.com/activecm/rita) - Open source framework for network traffic analysis that ingests Zeek logs and detects beaconing, DNS tunneling, and more.[39m
[38;5;12m- [39m[38;5;14m[1mRespounder[0m[38;5;12m (https://github.com/codeexpress/respounder) - Detects the presence of the Responder LLMNR/NBT-NS/MDNS poisoner on a network.[39m
[38;5;12m- [39m[38;5;14m[1mSnort[0m[38;5;12m (https://snort.org/) - Widely-deployed, Free Software IPS capable of real-time packet analysis, traffic logging, and custom rule-based triggers.[39m
[38;5;12m- [39m[38;5;14m[1mSpoofSpotter[0m[38;5;12m (https://github.com/NetSPI/SpoofSpotter) - Catch spoofed NetBIOS Name Service (NBNS) responses and alert to an email or log file.[39m
[38;5;12m- [39m[38;5;14m[1mStenographer[0m[38;5;12m (https://github.com/google/stenographer) - Full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes.[39m
[38;5;12m- [39m[38;5;14m[1mSuricata[0m[38;5;12m (https://suricata-ids.org/) - Free, cross-platform, IDS/IPS with on- and off-line analysis modes and deep packet inspection capabilities that is also scriptable with Lua.[39m
[38;5;12m- [39m[38;5;14m[1mTsunami[0m[38;5;12m (https://github.com/google/tsunami-security-scanner) - General purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence. [39m
[38;5;12m- [39m[38;5;14m[1mVAST[0m[38;5;12m (https://github.com/tenzir/vast) - Free and open-source network telemetry engine for data-driven security investigations.[39m
[38;5;12m- [39m[38;5;14m[1mWireshark[0m[38;5;12m (https://www.wireshark.org) - Free and open-source packet analyzer useful for network troubleshooting or forensic netflow analysis.[39m
[38;5;12m- [39m[38;5;14m[1mZeek[0m[38;5;12m (https://zeek.org/) - Powerful network analysis framework focused on security monitoring, formerly known as Bro.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mnetsniff-ng[0m[38;5;12m [39m[38;5;12m(http://netsniff-ng.org/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m  [39m[38;5;12mFree[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mfast[39m[38;5;12m [39m[38;5;12mGNU/Linux[39m[38;5;12m [39m[38;5;12mnetworking[39m[38;5;12m [39m[38;5;12mtoolkit[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mnumerous[39m[38;5;12m [39m[38;5;12mutilities[39m[38;5;12m [39m[38;5;12msuch[39m[38;5;12m [39m[38;5;12mas[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mconnection[39m[38;5;12m [39m[38;5;12mtracking[39m[38;5;12m [39m[38;5;12mtool[39m[38;5;12m [39m[38;5;12m([39m[48;5;235m[38;5;249mflowtop[49m[39m[38;5;12m),[39m[38;5;12m [39m[38;5;12mtraffic[39m[38;5;12m [39m[38;5;12mgenerator[39m[38;5;12m [39m[38;5;12m([39m[48;5;235m[38;5;249mtrafgen[49m[39m[38;5;12m),[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mautonomous[39m[38;5;12m [39m[38;5;12msystem[39m[38;5;12m [39m[38;5;12m(AS)[39m[38;5;12m [39m[38;5;12mtrace[39m[38;5;12m [39m[38;5;12mroute[39m[38;5;12m [39m[38;5;12mutility[39m[38;5;12m [39m[38;5;12m([39m
[48;5;235m[38;5;249mastraceroute[49m[39m[38;5;12m).[39m

[38;2;255;187;0m[4mSecurity Information and Event Management (SIEM)[0m

[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mAlienVault[0m[38;5;14m[1m [0m[38;5;14m[1mOSSIM[0m[38;5;12m [39m[38;5;12m(https://www.alienvault.com/open-threat-exchange/projects)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mSingle-server[39m[38;5;12m [39m[38;5;12mopen[39m[38;5;12m [39m[38;5;12msource[39m[38;5;12m [39m[38;5;12mSIEM[39m[38;5;12m [39m[38;5;12mplatform[39m[38;5;12m [39m[38;5;12mfeaturing[39m[38;5;12m [39m[38;5;12masset[39m[38;5;12m [39m[38;5;12mdiscovery,[39m[38;5;12m [39m[38;5;12masset[39m[38;5;12m [39m[38;5;12minventorying,[39m[38;5;12m [39m[38;5;12mbehavioral[39m[38;5;12m [39m[38;5;12mmonitoring,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mevent[39m[38;5;12m [39m[38;5;12mcorrelation,[39m[38;5;12m [39m[38;5;12mdriven[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mAlienVault[39m[38;5;12m [39m
[38;5;12mOpen[39m[38;5;12m [39m[38;5;12mThreat[39m[38;5;12m [39m[38;5;12mExchange[39m[38;5;12m [39m[38;5;12m(OTX).[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mPrelude[0m[38;5;14m[1m [0m[38;5;14m[1mSIEM[0m[38;5;14m[1m [0m[38;5;14m[1mOSS[0m[38;5;12m [39m[38;5;12m(https://www.prelude-siem.org/)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mOpen[39m[38;5;12m [39m[38;5;12msource,[39m[38;5;12m [39m[38;5;12magentless[39m[38;5;12m [39m[38;5;12mSIEM[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mlong[39m[38;5;12m [39m[38;5;12mhistory[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mseveral[39m[38;5;12m [39m[38;5;12mcommercial[39m[38;5;12m [39m[38;5;12mvariants[39m[38;5;12m [39m[38;5;12mfeaturing[39m[38;5;12m [39m[38;5;12msecurity[39m[38;5;12m [39m[38;5;12mevent[39m[38;5;12m [39m[38;5;12mcollection,[39m[38;5;12m [39m[38;5;12mnormalization,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12malerting[39m[38;5;12m [39m[38;5;12mfrom[39m[38;5;12m [39m[38;5;12marbitrary[39m[38;5;12m [39m[38;5;12mlog[39m[38;5;12m [39m[38;5;12minput[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mnumerous[39m[38;5;12m [39m
[38;5;12mpopular[39m[38;5;12m [39m[38;5;12mmonitoring[39m[38;5;12m [39m[38;5;12mtools.[39m

[38;2;255;187;0m[4mService and performance monitoring[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-sysadmin#monitoring[0m[38;5;12m (https://github.com/n1trux/awesome-sysadmin#monitoring).[39m

[38;5;12m- [39m[38;5;14m[1mIcinga[0m[38;5;12m (https://icinga.com/) - Modular redesign of Nagios with pluggable user interfaces and an expanded set of data connectors, collectors, and reporting tools.[39m
[38;5;12m- [39m[38;5;14m[1mLocust[0m[38;5;12m (https://locust.io/) - Open source load testing tool in which you can define user behaviour with Python code and swarm your system with millions of simultaneous users.[39m
[38;5;12m- [39m[38;5;14m[1mNagios[0m[38;5;12m (https://nagios.org) - Popular network and service monitoring solution and reporting platform.[39m
[38;5;12m- [39m[38;5;14m[1mOpenNMS[0m[38;5;12m (https://opennms.org/) - Free and feature-rich networking monitoring system supporting multiple configurations, a variety of alerting mechanisms (email, XMPP, SMS), and numerous data collection methods (SNMP, HTTP, JDBC, etc).[39m
[38;5;12m- [39m[38;5;14m[1mosquery[0m[38;5;12m (https://github.com/facebook/osquery) - Operating system instrumentation framework for macOS, Windows, and Linux, exposing the OS as a high-performance relational database that can be queried with a SQL-like syntax.[39m
[38;5;12m- [39m[38;5;14m[1mZabbix[0m[38;5;12m (https://www.zabbix.com/) - Mature, enterprise-level platform to monitor large-scale IT environments.[39m

[38;2;255;187;0m[4mThreat hunting[0m

[38;5;12m(Also known as [39m[48;2;30;30;40m[38;5;13m[3mhunt teaming[0m[38;5;12m and [39m[48;2;30;30;40m[38;5;13m[3mthreat detection[0m[38;5;12m.)[39m

[38;5;12mSee also [39m[38;5;14m[1mawesome-threat-detection[0m[38;5;12m (https://github.com/0x4D31/awesome-threat-detection).[39m

[38;5;12m- [39m[38;5;14m[1mCimSweep[0m[38;5;12m (https://github.com/PowerShellMafia/CimSweep) - Suite of CIM/WMI-based tools enabling remote incident response and hunting operations across all versions of Windows.[39m
[38;5;12m- [39m[38;5;14m[1mDeepBlueCLI[0m[38;5;12m (https://github.com/sans-blue-team/DeepBlueCLI) - PowerShell module for hunt teaming via Windows Event logs.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mGRR[0m[38;5;14m[1m [0m[38;5;14m[1mRapid[0m[38;5;14m[1m [0m[38;5;14m[1mResponse[0m[38;5;12m [39m[38;5;12m(https://github.com/google/grr)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mIncident[39m[38;5;12m [39m[38;5;12mresponse[39m[38;5;12m [39m[38;5;12mframework[39m[38;5;12m [39m[38;5;12mfocused[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12mremote[39m[38;5;12m [39m[38;5;12mlive[39m[38;5;12m [39m[38;5;12mforensics[39m[38;5;12m [39m[38;5;12mconsisting[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mPython[39m[38;5;12m [39m[38;5;12magent[39m[38;5;12m [39m[38;5;12minstalled[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12massets[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mPython-based[39m[38;5;12m [39m[38;5;12mserver[39m[38;5;12m [39m[38;5;12minfrastructure[39m[38;5;12m [39m[38;5;12menabling[39m[38;5;12m [39m[38;5;12manalysts[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mquickly[39m[38;5;12m [39m
[38;5;12mtriage[39m[38;5;12m [39m[38;5;12mattacks[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mperform[39m[38;5;12m [39m[38;5;12manalysis[39m[38;5;12m [39m[38;5;12mremotely.[39m
[38;5;12m- [39m[38;5;14m[1mHunting ELK (HELK)[0m[38;5;12m (https://github.com/Cyb3rWard0g/HELK) - All-in-one Free Software threat hunting stack based on Elasticsearch, Logstash, Kafka, and Kibana with various built-in integrations for analytics including Jupyter Notebook.[39m
[38;5;12m- [39m[38;5;14m[1mLogging Made Easy (LME)[0m[38;5;12m (https://www.cisa.gov/resources-tools/services/logging-made-easy) - Free and open logging and protective monitoring solution serving.[39m
[38;5;12m- [39m[38;5;14m[1mMozDef[0m[38;5;12m (https://github.com/mozilla/MozDef) - Automate the security incident handling process and facilitate the real-time activities of incident handlers.[39m
[38;5;12m- [39m[38;5;14m[1mPSHunt[0m[38;5;12m (https://github.com/Infocyte/PSHunt) - PowerShell module designed to scan remote endpoints for indicators of compromise or survey them for more comprehensive information related to state of those systems.[39m
[38;5;12m- [39m[38;5;14m[1mPSRecon[0m[38;5;12m (https://github.com/gfoss/PSRecon) - PSHunt-like tool for analyzing remote Windows systems that also produces a self-contained HTML report of its findings.[39m
[38;5;12m- [39m[38;5;14m[1mPowerForensics[0m[38;5;12m (https://github.com/Invoke-IR/PowerForensics) - All in one PowerShell-based platform to perform live hard disk forensic analysis.[39m
[38;5;12m- [39m[38;5;14m[1mRedline[0m[38;5;12m (https://www.fireeye.com/services/freeware/redline.html) - Freeware endpoint auditing and analysis tool that provides host-based investigative capabilities, offered by FireEye, Inc.[39m
[38;5;12m- [39m[38;5;14m[1mrastrea2r[0m[38;5;12m (https://github.com/rastrea2r/rastrea2r) - Multi-platform tool for triaging suspected IOCs on many endpoints simultaneously and that integrates with antivirus consoles.[39m

[38;2;255;187;0m[4mThreat intelligence[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-threat-intelligence[0m[38;5;12m (https://github.com/hslatman/awesome-threat-intelligence).[39m

[38;5;12m- [39m[38;5;14m[1mAttackerKB[0m[38;5;12m (https://attackerkb.com/) - Free and public crowdsourced vulnerability assessment platform to help prioritize high-risk patch application and combat vulnerability fatigue.[39m
[38;5;12m- [39m[38;5;14m[1mDATA[0m[38;5;12m (https://github.com/hadojae/DATA) - Credential phish analysis and automation tool that can accept suspected phishing URLs directly or trigger on observed network traffic containing such a URL.[39m
[38;5;12m- [39m[38;5;14m[1mForager[0m[38;5;12m (https://github.com/opensourcesec/Forager) - Multi-threaded threat intelligence gathering built with Python3 featuring simple text-based configuration and data storage for ease of use and data portability.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mGRASSMARLIN[0m[38;5;12m [39m[38;5;12m(https://github.com/nsacyber/GRASSMARLIN)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mProvides[39m[38;5;12m [39m[38;5;12mIP[39m[38;5;12m [39m[38;5;12mnetwork[39m[38;5;12m [39m[38;5;12msituational[39m[38;5;12m [39m[38;5;12mawareness[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mindustrial[39m[38;5;12m [39m[38;5;12mcontrol[39m[38;5;12m [39m[38;5;12msystems[39m[38;5;12m [39m[38;5;12m(ICS)[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mSupervisory[39m[38;5;12m [39m[38;5;12mControl[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mData[39m[38;5;12m [39m[38;5;12mAcquisition[39m[38;5;12m [39m[38;5;12m(SCADA)[39m[38;5;12m [39m[38;5;12mby[39m[38;5;12m [39m[38;5;12mpassively[39m[38;5;12m [39m[38;5;12mmapping,[39m[38;5;12m [39m[38;5;12maccounting[39m[38;5;12m [39m[38;5;12mfor,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m
[38;5;12mreporting[39m[38;5;12m [39m[38;5;12mon[39m[38;5;12m [39m[38;5;12myour[39m[38;5;12m [39m[38;5;12mICS/SCADA[39m[38;5;12m [39m[38;5;12mnetwork[39m[38;5;12m [39m[38;5;12mtopology[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mendpoints.[39m
[38;5;12m- [39m[38;5;14m[1mMLSec Combine[0m[38;5;12m (https://github.com/mlsecproject/combine) - Gather and combine multiple threat intelligence feed sources into one customizable, standardized CSV-based format.[39m
[38;5;12m- [39m[38;5;14m[1mMalware Information Sharing Platform and Threat Sharing (MISP)[0m[38;5;12m (https://misp-project.org/) - Open source software solution for collecting, storing, distributing and sharing cyber security indicators.[39m
[38;5;12m- [39m[38;5;14m[1mOpen Source Vulnerabilities (OSV)[0m[38;5;12m (https://osv.dev/) - Vulnerability database and triage infrastructure for open source projects aimed at helping both open source maintainers and consumers of open source.[39m
[38;5;12m- [39m[38;5;14m[1mSigma[0m[38;5;12m (https://github.com/Neo23x0/sigma) - Generic signature format for SIEM systems, offering an open signature format that allows you to describe relevant log events in a straightforward manner.[39m
[38;5;12m- [39m[38;5;14m[1mThreat Bus[0m[38;5;12m (https://github.com/tenzir/threatbus) - Threat intelligence dissemination layer to connect security tools through a distributed publish/subscribe message broker.[39m
[38;5;12m- [39m[38;5;14m[1mThreatIngestor[0m[38;5;12m (https://github.com/InQuest/ThreatIngestor) - Extendable tool to extract and aggregate IOCs from threat feeds including Twitter, RSS feeds, or other sources.[39m
[38;5;12m- [39m[38;5;14m[1mUnfetter[0m[38;5;12m (https://nsacyber.github.io/unfetter/) - Identifies defensive gaps in security posture by leveraging Mitre's ATT&CK framework.[39m
[38;5;12m- [39m[38;5;14m[1mViper[0m[38;5;12m (https://github.com/viper-framework/viper) - Binary analysis and management framework enabling easy organization of malware and exploit samples.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mYARA[0m[38;5;12m [39m[38;5;12m(https://github.com/VirusTotal/yara)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mTool[39m[38;5;12m [39m[38;5;12maimed[39m[38;5;12m [39m[38;5;12mat[39m[38;5;12m [39m[38;5;12m(but[39m[38;5;12m [39m[38;5;12mnot[39m[38;5;12m [39m[38;5;12mlimited[39m[38;5;12m [39m[38;5;12mto)[39m[38;5;12m [39m[38;5;12mhelping[39m[38;5;12m [39m[38;5;12mmalware[39m[38;5;12m [39m[38;5;12mresearchers[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12midentify[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mclassify[39m[38;5;12m [39m[38;5;12mmalware[39m[38;5;12m [39m[38;5;12msamples,[39m[38;5;12m [39m[38;5;12mdescribed[39m[38;5;12m [39m[38;5;12mas[39m[38;5;12m [39m[38;5;12m"the[39m[38;5;12m [39m[38;5;12mpattern[39m[38;5;12m [39m[38;5;12mmatching[39m[38;5;12m [39m[38;5;12mswiss[39m[38;5;12m [39m[38;5;12marmy[39m[38;5;12m [39m[38;5;12mknife"[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mfile[39m[38;5;12m [39m[38;5;12mpatterns[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m
[38;5;12msignatures.[39m

[38;2;255;187;0m[4mFingerprinting[0m

[38;5;12m- [39m[38;5;14m[1mHASSH[0m[38;5;12m (https://github.com/salesforce/hassh) - Network fingerprinting standard which can be used to identify specific client and server SSH implementations.[39m
[38;5;12m- [39m[38;5;14m[1mJA3[0m[38;5;12m (https://ja3er.com/) - Extracts SSL/TLS handshake settings for fingerprinting and communicating about a given TLS implementation.[39m

[38;2;255;187;0m[4mThreat signature packages and collections[0m

[38;5;12m- [39m[38;5;14m[1mESET's Malware IoCs[0m[38;5;12m (https://github.com/eset/malware-ioc) - Indicators of Compromises (IOCs) derived from ESET's various investigations.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mFireEye's[0m[38;5;14m[1m [0m[38;5;14m[1mRed[0m[38;5;14m[1m [0m[38;5;14m[1mTeam[0m[38;5;14m[1m [0m[38;5;14m[1mTool[0m[38;5;14m[1m [0m[38;5;14m[1mCountermeasures[0m[38;5;12m [39m[38;5;12m(https://github.com/fireeye/red_team_tool_countermeasures)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mCollection[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mSnort[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mYARA[39m[38;5;12m [39m[38;5;12mrules[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mdetect[39m[38;5;12m [39m[38;5;12mattacks[39m[38;5;12m [39m[38;5;12mcarried[39m[38;5;12m [39m[38;5;12mout[39m[38;5;12m [39m[38;5;12mwith[39m[38;5;12m [39m[38;5;12mFireEye's[39m[38;5;12m [39m[38;5;12mown[39m[38;5;12m [39m[38;5;12mRed[39m[38;5;12m [39m[38;5;12mTeam[39m[38;5;12m [39m[38;5;12mtools,[39m[38;5;12m [39m[38;5;12mfirst[39m[38;5;12m [39m[38;5;12mreleased[39m[38;5;12m [39m[38;5;12mafter[39m[38;5;12m [39m[38;5;12mFireEye[39m[38;5;12m [39m
[38;5;12mdisclosed[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mbreach[39m[38;5;12m [39m[38;5;12min[39m[38;5;12m [39m[38;5;12mDecember[39m[38;5;12m [39m[38;5;12m2020.[39m
[38;5;12m- [39m[38;5;14m[1mFireEye's Sunburst Countermeasures[0m[38;5;12m (https://github.com/fireeye/sunburst_countermeasures) - Collection of IoC in various languages for detecting backdoored SolarWinds Orion NMS activities and related vulnerabilities.[39m
[38;5;12m- [39m[38;5;14m[1mYARA Rules[0m[38;5;12m (https://github.com/Yara-Rules/rules) - Project covering the need for IT security researchers to have a single repository where different Yara signatures are compiled, classified and kept as up to date as possible.[39m

[38;2;255;187;0m[4mTor Onion service defenses[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-tor[0m[38;5;12m (https://github.com/ajvb/awesome-tor).[39m

[38;5;12m- [39m[38;5;14m[1mOnionBalance[0m[38;5;12m (https://onionbalance.readthedocs.io/) - Provides load-balancing while also making Onion services more resilient and reliable by eliminating single points-of-failure.[39m
[38;5;12m- [39m[38;5;14m[1mVanguards[0m[38;5;12m (https://github.com/mikeperry-tor/vanguards) - Version 3 Onion service guard discovery attack mitigation script (intended for eventual inclusion in Tor core).[39m

[38;2;255;187;0m[4mTransport-layer defenses[0m

[38;5;12m- [39m[38;5;14m[1mCertbot[0m[38;5;12m (https://certbot.eff.org/) - Free tool to automate the issuance and renewal of TLS certificates from the [39m[38;5;14m[1mLetsEncrypt Root CA[0m[38;5;12m (https://letsencrypt.org/) with plugins that configure various Web and e-mail server software.[39m
[38;5;12m- [39m[38;5;14m[1mMITMEngine[0m[38;5;12m (https://github.com/cloudflare/mitmengine) - Golang library for server-side detection of TLS interception events.[39m
[38;5;12m- [39m[38;5;14m[1mTor[0m[38;5;12m (https://torproject.org/) - Censorship circumvention and anonymizing overlay network providing distributed, cryptographically verified name services ([39m[48;5;235m[38;5;249m.onion[49m[39m[38;5;12m domains) to enhance publisher privacy and service availability.[39m

[38;2;255;187;0m[4mOverlay and Virtual Private Networks (VPNs)[0m

[38;5;12m- [39m[38;5;14m[1mFirezone[0m[38;5;12m (https://www.firezone.dev/) - Self-hosted VPN server built on WireGuard that supports MFA and SSO.[39m
[38;5;12m- [39m[38;5;14m[1mHeadscale[0m[38;5;12m (https://github.com/juanfont/headscale) - Open source, self-hosted implementation of the Tailscale control server.[39m
[38;5;12m- [39m[38;5;14m[1mIPsec VPN Server Auto Setup Scripts[0m[38;5;12m (https://github.com/hwdsl2/setup-ipsec-vpn) - Scripts to build your own IPsec VPN server, with IPsec/L2TP, Cisco IPsec and IKEv2.[39m
[38;5;12m- [39m[38;5;14m[1mInnernet[0m[38;5;12m (https://github.com/tonarino/innernet) - Free Software private network system that uses WireGuard under the hood, made to be self-hosted.[39m
[38;5;12m- [39m[38;5;14m[1mNebula[0m[38;5;12m (https://github.com/slackhq/nebula) - Completely open source and self-hosted, scalable overlay networking tool with a focus on performance, simplicity, and security, inspired by tinc.[39m
[38;5;12m- [39m[38;5;14m[1mOpenVPN[0m[38;5;12m (https://openvpn.net/) - Longstanding Free Software traditional SSL/TLS-based virtual private network.[39m
[38;5;12m- [39m[38;5;14m[1mOpenZITI[0m[38;5;12m (https://openziti.github.io/) - Open source initiative focused on bringing Zero Trust to any application via an overlay network, tunelling applications, and numerous SDKs.[39m
[38;5;12m- [39m[38;5;14m[1mTailscale[0m[38;5;12m (https://tailscale.com/) - Managed freemium mesh VPN service built on top of WireGuard.[39m
[38;5;12m- [39m[38;5;14m[1mWireGuard[0m[38;5;12m (https://www.wireguard.com/) - Extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography.[39m
[38;5;12m- [39m[38;5;14m[1mtinc[0m[38;5;12m (https://tinc-vpn.org/) - Free Software mesh VPN implemented entirely in userspace that supports expandable network space, bridged ethernet segments, and more.[39m

[38;2;255;187;0m[4mmacOS-based defenses[0m

[38;5;12mSee also [39m[38;5;14m[1mdrduh/macOS-Security-and-Privacy-Guide[0m[38;5;12m (https://github.com/drduh/macOS-Security-and-Privacy-Guide).[39m

[38;5;12m- [39m[38;5;14m[1mBlockBlock[0m[38;5;12m (https://objective-see.com/products/blockblock.html) - Monitors common persistence locations and alerts whenever a persistent component is added, which helps to detect and prevent malware installation.[39m
[38;5;12m- [39m[38;5;14m[1mLuLu[0m[38;5;12m (https://objective-see.com/products/lulu.html) - Free macOS firewall.[39m
[38;5;12m- [39m[38;5;14m[1mSanta[0m[38;5;12m (https://github.com/google/santa) - Keep track of binaries that are naughty or nice in an allow/deny-listing system for macOS.[39m
[38;5;12m- [39m[38;5;14m[1mStronghold[0m[38;5;12m (https://github.com/alichtman/stronghold) - Easily configure macOS security settings from the terminal.[39m
[38;5;12m- [39m[38;5;14m[1mmacOS Fortress[0m[38;5;12m (https://github.com/essandess/macOS-Fortress) - Automated configuration of kernel-level, OS-level, and client-level security features including privatizing proxying and anti-virus scanning for macOS.[39m

[38;2;255;187;0m[4mWindows-based defenses[0m

[38;5;12mSee also [39m[38;5;14m[1mawesome-windows#security[0m[38;5;12m (https://github.com/Awesome-Windows/Awesome#security) and [39m[38;5;14m[1mawesome-windows-domain-hardening[0m[38;5;12m (https://github.com/PaulSec/awesome-windows-domain-hardening).[39m

[38;5;12m- [39m[38;5;14m[1mCobaltStrikeScan[0m[38;5;12m (https://github.com/Apr4h/CobaltStrikeScan) - Scan files or process memory for Cobalt Strike beacons and parse their configuration.[39m
[38;5;12m- [39m[38;5;14m[1mHardenTools[0m[38;5;12m (https://github.com/securitywithoutborders/hardentools) - Utility that disables a number of risky Windows features.[39m
[38;5;12m- [39m[38;5;14m[1mNotRuler[0m[38;5;12m (https://github.com/sensepost/notruler) - Detect both client-side rules and VBScript enabled forms used by the [39m[38;5;14m[1mRuler[0m[38;5;12m (https://github.com/sensepost/ruler) attack tool when attempting to compromise a Microsoft Exchange server.[39m
[38;5;12m- [39m[38;5;14m[1mSandboxie[0m[38;5;12m (https://www.sandboxie.com/) - Free and open source general purpose Windows application sandboxing utility.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mSigcheck[0m[38;5;12m [39m[38;5;12m(https://docs.microsoft.com/en-us/sysinternals/downloads/sigcheck)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mAudit[39m[38;5;12m [39m[38;5;12ma[39m[38;5;12m [39m[38;5;12mWindows[39m[38;5;12m [39m[38;5;12mhost's[39m[38;5;12m [39m[38;5;12mroot[39m[38;5;12m [39m[38;5;12mcertificate[39m[38;5;12m [39m[38;5;12mstore[39m[38;5;12m [39m[38;5;12magainst[39m[38;5;12m [39m[38;5;12mMicrosoft's[39m[38;5;12m [39m[38;5;14m[1mCertificate[0m[38;5;14m[1m [0m[38;5;14m[1mTrust[0m[38;5;14m[1m [0m[38;5;14m[1mList[0m[38;5;14m[1m [0m[38;5;14m[1m(CTL)[0m[38;5;12m [39m
[38;5;12m(https://docs.microsoft.com/en-us/windows/desktop/SecCrypto/certificate-trust-list-overview).[39m
[38;5;12m- [39m[38;5;14m[1mSticky Keys Slayer[0m[38;5;12m (https://github.com/linuz/Sticky-Keys-Slayer) - Establishes a Windows RDP session from a list of hostnames and scans for accessibility tools backdoors, alerting if one is discovered.[39m
[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mWindows[0m[38;5;14m[1m [0m[38;5;14m[1mSecure[0m[38;5;14m[1m [0m[38;5;14m[1mHost[0m[38;5;14m[1m [0m[38;5;14m[1mBaseline[0m[38;5;12m [39m[38;5;12m(https://github.com/nsacyber/Windows-Secure-Host-Baseline)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mGroup[39m[38;5;12m [39m[38;5;12mPolicy[39m[38;5;12m [39m[38;5;12mobjects,[39m[38;5;12m [39m[38;5;12mcompliance[39m[38;5;12m [39m[38;5;12mchecks,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mconfiguration[39m[38;5;12m [39m[38;5;12mtools[39m[38;5;12m [39m[38;5;12mthat[39m[38;5;12m [39m[38;5;12mprovide[39m[38;5;12m [39m[38;5;12man[39m[38;5;12m [39m[38;5;12mautomated[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mflexible[39m[38;5;12m [39m[38;5;12mapproach[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12msecurely[39m[38;5;12m [39m[38;5;12mdeploying[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m
[38;5;12mmaintaining[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mlatest[39m[38;5;12m [39m[38;5;12mreleases[39m[38;5;12m [39m[38;5;12mof[39m[38;5;12m [39m[38;5;12mWindows[39m[38;5;12m [39m[38;5;12m10.[39m
[38;5;12m- [39m[38;5;14m[1mWMI Monitor[0m[38;5;12m (https://github.com/realparisi/WMI_Monitor) - Log newly created WMI consumers and processes to the Windows Application event log.[39m

[38;2;255;187;0m[4mActive Directory[0m

[38;5;12m- [39m[38;5;14m[1mActive Directory Control Paths[0m[38;5;12m (https://github.com/ANSSI-FR/AD-control-paths) - Visualize and graph Active Directory permission configs ("control relations") to audit questions such as "Who can read the CEO's email?" and similar.[39m
[38;5;12m- [39m[38;5;14m[1mPingCastle[0m[38;5;12m (https://www.pingcastle.com/) - Active Directory vulnerability detection and reporting tool.[39m
[38;5;12m- [39m[38;5;14m[1mPlumHound[0m[38;5;12m (https://github.com/PlumHound/PlumHound) - More effectively use BloodHoundAD in continual security life-cycles by utilizing its pathfinding engine to identify Active Directory security vulnerabilities.[39m

[38;2;255;187;0m[4mLicense[0m

[38;5;14m[1m![0m[38;5;12mCC-BY[39m[38;5;14m[1m (https://mirrors.creativecommons.org/presskit/buttons/88x31/svg/by.svg)[0m[38;5;12m (https://creativecommons.org/licenses/by/4.0/)[39m

[38;5;12mThis work is licensed under a [39m[38;5;14m[1mCreative Commons Attribution 4.0 International License[0m[38;5;12m (https://creativecommons.org/licenses/by/4.0/).[39m
