Tools for blue team

Make a system look as if it was hit by an APT.

Navigate and annotate MITRE ATT&CK.

Safely simulate malicious network traffic.

File triage and malware analysis pipeline.

Small, portable ATT&CK detection tests.

Cloud forensics for Azure / O365.

Web-based SSH bastion and key manager.

Active Directory attack-path graphing.

Cloud-native open-source WAF.

Malware sandbox + payload extraction.

CISA's DFIR tool.

Tripwire tokens for free.

Hunt across Windows event logs at speed.

Visualize AWS environments.

Observable analysis engine for TheHive.

Medium-interaction SSH/Telnet honeypot.

Hunt PowerShell attacks in Windows logs.

Automated detection lab environment.

Forensic artifact framework from Fox-IT.

Network forensic analysis framework.

SSH tarpit that wastes attacker time.

Malware analysis automation.

Fast Incident Response platform.

Ban hosts that fail auth too often.