Tools for blue team

Evaluate IAM permissions in AWS.

C++ library for packet capture and crafting.

Active Directory health audit.

BloodHound reporting for defenders.

Live PowerShell disk forensics.

Multi-cloud security posture.

Endgame's ATT&CK simulation framework.

Self-hosted open-source WAF.

Python packet manipulation library.

Multi-cloud security auditing.

Open SOC distribution.

Remote SSH for the edge.

Open-source SOAR.

Vendor-agnostic detection rules.

Open-source IPS, next generation.

CVE intelligence and exploit lookup CLI.

Build vulnerable instrumented labs.

Cloud adversary emulation.

High-performance IDS / IPS.

Battle-tested Sysmon configuration.

Microsoft's Sysmon, on Linux.

All-in-one honeypot platform.

Wireshark on the command line.

Zero-trust access for SSH, K8s and more.