Tools for blue team

Open-source SIRP for incident response.

Open-source cloud-native protection platform.

Honeytoken tripwire for the Shai-Hulud npm worm.

Collaborative forensic timeline analysis platform.

Container and IaC vulnerability scanner.

Unix-like artifact collector.

Zero-install cross-platform incident response and DFIR toolkit.

Endpoint visibility and DFIR.

Agent-less Linux vulnerability scanner.

Open-source EDR for Windows.

Open-source XDR and SIEM.

Network protocol analyzer.

Pattern matching for malware research.

Community YARA rule repository.

Open-source threat-intel platform.

Self-hosted identity and access management platform.

Network analysis framework.

Read-only host scanner for Candiru/AdFection spyware IOCs.

Catch malicious AUR packages before makepkg builds them.

Multi-layer bot detection for browser and server.

Identify executable capabilities.

Detect typosquats and phishing domains.

Audit Keycloak configuration for security misconfigurations

Detect malicious capabilities in code, binaries and containers.