Tools for blue team

Network forensic analysis framework.

SSH tarpit that wastes attacker time.

Windows ETW provider browser and trace inspector.

Malware analysis automation.

Fast Incident Response platform.

Ban hosts that fail auth too often.

Dynamic network analysis for malware.

Runtime security for containers.

Open vulnerability management platform.

Adversary tradecraft detection on Windows.

Osquery-powered device management.

Security advisories + PoCs from Google.

Open log management.

The Hunting ELK stack.

Windows hardening for high-risk users.

Windows event log threat hunter.

Open-source adversary emulation platform.

Manage threat intel at scale.

Visualize Windows logon events.

Simple IOC and YARA scanner.

Linux / macOS / Unix security auditor.

Threat intelligence sharing platform.

Automated adversary emulation.

Microsoft Threat Intelligence in Python.