threat-intelligence

mukul975/Anthropic-Cybersecurity-Skills

818 cybersecurity skills to turn AI agents into security analysts — A community-built library of 818 structured cybersecurity skills across 34 domains, following the agentskills.io standard. Each skill is mapped to relevant frameworks (MITRE ATT&CK, NIST CSF 2.0, ATLAS, D3FEND, NIST AI RMF, F3) and works with Claude Code, Copilot, Cursor, and 20+ other AI platforms. Useful for red teamers, SOC analysts, and anyone wiring domain expertise into AI agents.

smicallef/spiderfoot

Automated OSINT recon with 200+ modules and built-in correlation — SpiderFoot automates OSINT gathering across 200+ modules, with a YAML-configurable correlation engine and 37 pre-defined rules to surface findings. It offers both a web UI and CLI, TOR integration, Docker support, and integrates external tools like Nmap and DNSTwist—useful for pentesters and threat intel analysts mapping attack surfaces.

blacklanternsecurity/bbot

BBOT 3.0: a recursive OSINT scanner with breaking CLI changes — BBOT is a Spiderfoot-inspired recursive scanner for recon, bug bounties, and attack surface management, chaining passive APIs with DNS brute-force and mutations. Version 3.0 brings breaking changes to CLI, presets, modules, and events, plus a faster multithreaded DNS resolver (blastdns) for quicker scans.

OpenCTI-Platform/opencti

A structured knowledge base for managing cyber threat intelligence — OpenCTI organizes technical and non-technical threat intelligence using the STIX2 schema, letting security teams structure, store and visualize observables and knowledge. It fits analysts, SOC teams and CTI practitioners who need a shared, standards-based platform rather than scattered reports and spreadsheets.

beenuar/AiSOC

A self-hostable SOC that lets AI agents triage alerts, auditably — AiSOC fuses alerts from your security tools, correlates them against 2,530 executable rules from a 7,015-rule library, and lets AI agents investigate each incident with every prompt and tool call logged for replay. It runs self-hosted with no API keys required, ships an MCP server for Claude, Cursor and Continue, and keeps a human approving any action before it reaches a vendor.

kaifcodec/user-scanner

A combined email and username OSINT scanner with native MCP support — This Python tool checks a single email or username across 2720+ scan vectors (210+ email sites, 2510+ username platforms) to map digital footprints and verify account registrations. Native MCP support lets it plug into AI workflows, making it useful for security researchers, investigators, and red teamers doing quick identity reconnaissance.

intelowlproject/IntelOwl

IntelOwl: manage your Threat Intelligence at scale

interplains/zero-breach

Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.

KatrielMoses/voidaccess

Open-source dark-web OSINT pipeline from query to graph in 13 steps — VoidAccess is a self-hosted CLI tool that automates dark-web threat intelligence: parallel Tor/paste/feed collection, entity extraction (IOCs, wallets, actors), enrichment, and relationship graphing. It's pitched as a free, open alternative to commercial platforms like Recorded Future, DarkOwl, and Flare, aimed at security researchers and TI teams.

hedgerow-dev/coldframe

A single-file honeypot that impersonates real refrigeration controllers — coldframe is a dependency-free Python honeypot mimicking Danfoss AK-SM 800A and Dixell XWEB 500 refrigeration controllers, copying their TLS fingerprints, headers, login flows and even default credentials. It logs attacker IPs, passwords and exploit attempts (including CVE-2025-41450) while serving fake dashboards, useful for ICS defenders tracking real-world attacks on supermarket refrigeration systems.