Tools for blue team

Community YARA rule repository.

Open-source threat-intel platform.

Network analysis framework.

Catch malicious AUR packages before makepkg builds them.

Identify executable capabilities.

Detect typosquats and phishing domains.

Detect malicious capabilities in code, binaries and containers.

SQL-powered endpoint visibility.

SSH server and client config auditor.

Easy SSH honeypot.

Transparent SSH bastion.

Modular Sysmon configuration repo.

Command-line packet capture.

Test TLS/SSL on any port.