{"generated":"2026-10-20T09:07:51Z","thresholds":{"active_days":90,"slowing_days":365},"categories":[{"id":"malware-analysis","name":{"en":"Malware analysis","tr":"Zararlı yazılım analizi"}},{"id":"reverse-engineering","name":{"en":"Reverse engineering","tr":"Tersine mühendislik"}},{"id":"penetration-testing","name":{"en":"Penetration testing","tr":"Sızma testi"}},{"id":"digital-forensics","name":{"en":"Digital forensics","tr":"Dijital adli bilişim"}},{"id":"incident-response","name":{"en":"Incident response","tr":"Olay müdahalesi"}},{"id":"detection-engineering","name":{"en":"Detection engineering","tr":"Detection engineering"}},{"id":"network-monitoring","name":{"en":"Network monitoring","tr":"Ağ izleme"}},{"id":"threat-intelligence","name":{"en":"Threat intelligence","tr":"Tehdit istihbaratı"}},{"id":"cloud-security","name":{"en":"Cloud security","tr":"Bulut güvenliği"}}],"sources":[{"id":"awesome-cyber-security-tools","name":"awesome-cyber-security-tools","url":"https://github.com/0xh3xa/awesome-cyber-security-tools","license":"CC0-1.0"},{"id":"awesome-incident-response","name":"awesome-incident-response","url":"https://github.com/meirwah/awesome-incident-response","license":"Apache-2.0"},{"id":"awesome-forensics","name":"awesome-forensics","url":"https://github.com/cugu/awesome-forensics","license":"CC0-1.0"},{"id":"awesome-detection-engineering","name":"awesome-detection-engineering","url":"https://github.com/infosecB/awesome-detection-engineering","license":"CC0-1.0"},{"id":"awesome-threat-detection","name":"awesome-threat-detection","url":"https://github.com/0x4D31/awesome-threat-detection","license":"CC0-1.0"},{"id":"awesome-security","name":"awesome-security","url":"https://github.com/sbilly/awesome-security","license":"MIT"},{"id":"awesome-threat-intelligence","name":"awesome-threat-intelligence","url":"https://github.com/hslatman/awesome-threat-intelligence","license":"Apache-2.0"},{"id":"my-arsenal-of-aws-security-tools","name":"my-arsenal-of-aws-security-tools","url":"https://github.com/toniblyx/my-arsenal-of-aws-security-tools","license":"Apache-2.0"},{"id":"awesome-malware-analysis","name":"awesome-malware-analysis","url":"https://github.com/rshipp/awesome-malware-analysis","license":"CC-BY-4.0"}],"tools":[{"id":20387062,"repo":"horsicq/Detect-It-Easy","listed_as":"horsicq/Detect-It-Easy","name":"Detect-It-Easy","category":"malware-analysis","subcategory":"File Identification","description":"Program for determining types of files for Windows, Linux and MacOS.","license":"MIT","stars":11759,"archived":false,"last_commit":"2026-10-19T17:40:00Z","days_since_commit":0,"release":null,"weeks":[57,45,25,19,19,7,23,15,11,43,55,28,14,20,16,31,11,22,20,12,14,5,17,24,24,36,74,87,138,24,42,27,52,51,55,37,30,33,19,13,19,18,22,39,76,121,98,182,68,59,122,9],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":20387062,"owner_id":7762949,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":152290823,"repo":"EricZimmerman/KapeFiles","listed_as":"EricZimmerman/KapeFiles","name":"KapeFiles","category":"malware-analysis","subcategory":"File Identification","description":"This repository serves as a place for community created Targets and Modules for use with KAPE. ","license":"MIT","stars":888,"archived":false,"last_commit":"2026-10-12T23:24:18Z","days_since_commit":6,"release":null,"weeks":[5,1,0,0,0,0,0,2,2,6,0,0,0,3,4,1,4,5,5,21,0,0,0,0,0,3,8,0,0,2,0,4,0,1,0,0,0,0,0,0,0,0,0,0,2,42,17,0,0,1,1,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":152290823,"owner_id":4265254,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":102556798,"repo":"JPCERTCC/impfuzzy","listed_as":"JPCERTCC/impfuzzy","name":"impfuzzy","category":"malware-analysis","subcategory":"File Signature","description":"Fuzzy Hash calculated from import API of PE files","license":"GPL-2.0","stars":91,"archived":false,"last_commit":"2022-08-26T08:00:01Z","days_since_commit":1515,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":102556798,"owner_id":6404804,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":52326959,"repo":"knowmalware/pehash","listed_as":"knowmalware/pehash","name":"pehash","category":"malware-analysis","subcategory":"File Signature","description":"Compilation of peHash implementations.","license":"","stars":15,"archived":false,"last_commit":"2019-05-02T02:21:08Z","days_since_commit":2727,"release":{"tag":"v0.9.0","date":"2017-09-27T08:11:23Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":52326959,"owner_id":6180315,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":52993349,"repo":"mandiant/flare-floss","listed_as":"mandiant/flare-floss","name":"flare-floss","category":"malware-analysis","subcategory":"Strings","description":"FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.","license":"Apache-2.0","stars":4194,"archived":false,"last_commit":"2026-10-19T19:27:44Z","days_since_commit":0,"release":{"tag":"v3.2.0","date":"2026-10-16T10:51:32Z","assets":3,"verification":"none"},"weeks":[6,4,0,0,0,4,0,2,0,0,3,15,4,0,1,0,2,0,11,7,9,2,12,3,8,13,0,3,0,6,7,7,13,3,1,5,39,26,7,28,11,122,89,69,27,3,9,0,6,25,13,6],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":52993349,"owner_id":331209,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":null,"repo":"mwrlabs/stringsdump","listed_as":"mwrlabs/stringsdump","name":"StringsDump","category":"malware-analysis","subcategory":"Strings","description":"","license":"","stars":0,"archived":false,"last_commit":null,"days_since_commit":null,"release":null,"weeks":null,"advisories":null,"status":"unavailable","signals":[],"checked":"2026-10-19T19:43:57Z","history":[{"date":"2026-10-19","type":"first_seen","status":"unavailable"}],"source":"awesome-cyber-security-tools"},{"id":537996647,"repo":"hasherezade/pe-bear","listed_as":"hasherezade/pe-bear","name":"pe-bear","category":"malware-analysis","subcategory":"Inspector","description":"Portable Executable reversing tool with a friendly GUI ","license":"GPL-2.0","stars":3856,"archived":false,"last_commit":"2026-10-14T21:59:19Z","days_since_commit":4,"release":{"tag":"v0.7.2","date":"2026-06-05T20:23:57Z","assets":8,"verification":"none"},"weeks":[0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,1,0,0,0,0,0,0,0,0,0,0,0,0,5,0,2,0,4,0,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":537996647,"owner_id":3115348,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":7037996,"repo":"VirusTotal/yara","listed_as":"VirusTotal/yara","name":"yara","category":"malware-analysis","subcategory":"IOC and Pattern Identification","description":"The pattern matching swiss knife","license":"BSD-3-Clause","stars":9958,"archived":false,"last_commit":"2026-10-15T13:43:02Z","days_since_commit":4,"release":{"tag":"v4.5.8","date":"2026-07-28T07:12:15Z","assets":0,"verification":null},"weeks":[2,0,1,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,7,0,5,5,5,4,4,5,4,0,0,4,2,0,0,0,2,0,0,5,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":7037996,"owner_id":7701252,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":29420337,"repo":"Neo23x0/Loki","listed_as":"Neo23x0/Loki","name":"Loki","category":"malware-analysis","subcategory":"IOC and Pattern Identification","description":"Loki - Simple IOC and YARA Scanner","license":"GPL-3.0","stars":3801,"archived":false,"last_commit":"2026-01-09T17:50:50Z","days_since_commit":283,"release":{"tag":"v0.51.0","date":"2023-05-18T18:16:57Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":29420337,"owner_id":2851492,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}],"source":"awesome-cyber-security-tools"},{"id":63780063,"repo":"nlitsme/zipdump","listed_as":"nlitsme/zipdump","name":"zipdump","category":"malware-analysis","subcategory":"IOC and Pattern Identification","description":"Analyze zipfile, either local, or from url","license":"MIT","stars":39,"archived":false,"last_commit":"2024-10-03T13:09:57Z","days_since_commit":746,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":63780063,"owner_id":252693,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":33893135,"repo":"jesparza/peepdf","listed_as":"jesparza/peepdf","name":"pee-pdf","category":"malware-analysis","subcategory":"PDF","description":"Powerful Python tool to analyze PDF documents","license":"GPL-3.0","stars":1469,"archived":false,"last_commit":"2016-11-17T21:30:21Z","days_since_commit":3622,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":33893135,"owner_id":11930704,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":59367670,"repo":"decalage2/oletools","listed_as":"decalage2/oletools","name":"ole-tools","category":"malware-analysis","subcategory":"Microsoft Office","description":"oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.","license":"other","stars":3435,"archived":false,"last_commit":"2026-01-26T22:51:36Z","days_since_commit":265,"release":{"tag":"v0.60.2","date":"2024-07-02T14:57:56Z","assets":2,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":59367670,"owner_id":5989656,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}],"source":"awesome-cyber-security-tools"},{"id":69185746,"repo":"decalage2/ViperMonkey","listed_as":"decalage2/ViperMonkey","name":"ViperMonkey","category":"malware-analysis","subcategory":"Microsoft Office","description":"A VBA parser and emulation engine to analyze malicious macros.","license":"","stars":1132,"archived":false,"last_commit":"2024-04-25T21:27:29Z","days_since_commit":906,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":69185746,"owner_id":5989656,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":60485153,"repo":"tehsyntx/loffice","listed_as":"tehsyntx/loffice","name":"Lazy Office Analyzer","category":"malware-analysis","subcategory":"Microsoft Office","description":"Lazy Office Analyzer","license":"","stars":122,"archived":false,"last_commit":"2017-02-15T20:16:53Z","days_since_commit":3532,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":60485153,"owner_id":19692151,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":4849630,"repo":"a0rtega/pafish","listed_as":"a0rtega/pafish","name":"Pafish","category":"malware-analysis","subcategory":"Anti-Analysis Detector","description":"Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do","license":"GPL-3.0","stars":3941,"archived":true,"last_commit":"2021-11-09T16:17:18Z","days_since_commit":1805,"release":{"tag":"v0.6","date":"2021-11-09T16:47:18Z","assets":2,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":4849630,"owner_id":1909038,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}],"source":"awesome-cyber-security-tools"},{"id":148042405,"repo":"afrantzis/bless","listed_as":"afrantzis/bless","name":"Bless","category":"malware-analysis","subcategory":"Hex Editor","description":"Bless - Gtk# Hex Editor","license":"GPL-2.0","stars":256,"archived":false,"last_commit":"2021-10-02T13:26:34Z","days_since_commit":1843,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":148042405,"owner_id":495575,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":73656224,"repo":"briansteffens/hexitor","listed_as":"briansteffens/hexitor","name":"hexitor","category":"malware-analysis","subcategory":"Hex Editor","description":"Hex editor for the terminal","license":"GPL-2.0","stars":16,"archived":false,"last_commit":"2019-05-30T07:04:14Z","days_since_commit":2699,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":73656224,"owner_id":4149249,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":2341302,"repo":"cuckoosandbox/cuckoo","listed_as":"cuckoosandbox/cuckoo","name":"Cuckoo Sandbox","category":"malware-analysis","subcategory":"Dynamic Analysis Tools","description":"Cuckoo Sandbox is an automated dynamic malware analysis system","license":"other","stars":5958,"archived":true,"last_commit":"2021-04-26T15:48:32Z","days_since_commit":2002,"release":{"tag":"2.0.6","date":"2018-06-07T22:12:06Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":2341302,"owner_id":1032683,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}],"source":"awesome-cyber-security-tools"},{"id":62087069,"repo":"mandiant/flare-fakenet-ng","listed_as":"mandiant/flare-fakenet-ng","name":"Fakenet-NG","category":"malware-analysis","subcategory":"Dynamic Analysis Tools","description":"FakeNet-NG - Next Generation Dynamic Network Analysis Tool","license":"Apache-2.0","stars":2212,"archived":false,"last_commit":"2026-05-28T18:25:53Z","days_since_commit":144,"release":{"tag":"v3.5","date":"2025-04-09T15:52:48Z","assets":1,"verification":"none"},"weeks":[0,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":62087069,"owner_id":331209,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}],"source":"awesome-cyber-security-tools"},{"id":20642806,"repo":"vincentkoc/autosecure","listed_as":"vincentkoc/autosecure","name":"autosecure","category":"malware-analysis","subcategory":"Threat Intelligence","description":"Threat-feed IP block automation for Linux and macOS firewalls (iptables, nftables, pf) with cron-ready updates, dry-run previews, and package releases.","license":"GPL-3.0","stars":17,"archived":false,"last_commit":"2026-04-16T18:01:25Z","days_since_commit":186,"release":{"tag":"v2.3.4","date":"2026-04-16T17:57:36Z","assets":9,"verification":"signature"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,53,3,0,5,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":20642806,"owner_id":25068,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}],"source":"awesome-cyber-security-tools"},{"id":8859474,"repo":"skylot/jadx","listed_as":"skylot/jadx","name":"JADX","category":"reverse-engineering","subcategory":"Java Decompilers","description":"Dex to Java decompiler","license":"Apache-2.0","stars":51108,"archived":false,"last_commit":"2026-10-14T22:10:03Z","days_since_commit":4,"release":{"tag":"v1.5.6","date":"2026-07-10T19:07:35Z","assets":3,"verification":"none"},"weeks":[6,5,2,6,3,6,3,5,9,0,2,4,5,2,7,5,4,6,7,4,5,7,6,5,5,5,2,1,3,0,2,1,0,4,2,2,9,6,0,4,2,0,2,3,4,5,0,2,4,12,13,0],"advisories":[{"id":"GHSA-gpvc-ccw7-744v","cve":"CVE-2026-54684","severity":"high","published":"2026-07-10","summary":"XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run"},{"id":"GHSA-jwv3-q635-w9m4","cve":"CVE-2026-42447","severity":"low","published":"2026-07-10","summary":"HTML Injection in Summary panel"},{"id":"GHSA-w6f5-h4x4-rfpj","cve":"CVE-2026-42049","severity":"medium","published":"2026-07-10","summary":"RCE Via Groovy Code Injection in Gradle Export"},{"id":"GHSA-3pp3-hg2q-9gpm","cve":"CVE-2024-32653","severity":"medium","published":"2024-04-22","summary":"Insufficient input filtering of \"package name\" allows command execution in the device with shell privileges"},{"id":"GHSA-hvp5-5x4f-33fq","cve":"","severity":"low","published":"2024-04-22","summary":"jadx-gui file override"},{"id":"GHSA-3r7j-8mqh-6qhx","cve":"CVE-2022-39259","severity":"medium","published":"2022-10-20","summary":"Jadx-gui: Swing HTML DOS attack"},{"id":"GHSA-fjh6-p566-wr6q","cve":"CVE-2021-22569","severity":"medium","published":"2022-07-20","summary":"Vulnerable library protobuf-java 3.11.4"}],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":8859474,"owner_id":118523,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":24747351,"repo":"JetBrains/fernflower","listed_as":"fesh0r/fernflower","name":"FernFlower","category":"reverse-engineering","subcategory":"Java Decompilers","description":"Decompiler from Java bytecode to Java, used in IntelliJ IDEA.","license":"Apache-2.0","stars":4425,"archived":false,"last_commit":"2026-10-09T09:25:25Z","days_since_commit":10,"release":null,"weeks":[0,0,0,0,2,0,0,0,1,0,0,0,0,1,0,0,1,7,0,7,3,1,1,0,0,1,1,1,1,0,1,4,0,1,0,0,1,0,0,0,1,1,0,0,1,0,0,1,5,1,0,0],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"fesh0r/fernflower","to":"JetBrains/fernflower"},{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":24747351,"owner_id":878437,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":6304196,"repo":"Storyyeller/Krakatau","listed_as":"Storyyeller/krakatau","name":"Krakatau","category":"reverse-engineering","subcategory":"Java Decompilers","description":"Java decompiler, assembler, and disassembler","license":"GPL-3.0","stars":2261,"archived":false,"last_commit":"2026-09-25T02:25:59Z","days_since_commit":24,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,5,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":6304196,"owner_id":999674,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":38380854,"repo":"dnSpy/dnSpy","listed_as":"dnSpy/dnSpy","name":"dnSpy","category":"reverse-engineering","subcategory":".NET Decompilers","description":".NET debugger and assembly editor","license":"","stars":29661,"archived":true,"last_commit":"2020-12-07T21:07:17Z","days_since_commit":2141,"release":{"tag":"v6.1.8","date":"2020-12-07T21:21:10Z","assets":3,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_license"},{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":38380854,"owner_id":67931932,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}],"source":"awesome-cyber-security-tools"},{"id":1327739,"repo":"icsharpcode/ILSpy","listed_as":"icsharpcode/ILSpy","name":"ILSpy","category":"reverse-engineering","subcategory":".NET Decompilers","description":".NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!","license":"MIT","stars":26726,"archived":false,"last_commit":"2026-10-19T17:13:13Z","days_since_commit":0,"release":{"tag":"v11.1","date":"2026-09-23T06:43:43Z","assets":10,"verification":"none"},"weeks":[0,7,7,10,5,9,6,10,8,9,2,5,0,2,0,1,0,2,1,1,13,12,6,4,13,10,72,138,115,48,41,83,141,84,42,78,40,16,35,80,45,75,48,73,111,58,30,35,34,53,64,18],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":1327739,"owner_id":343434,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":48010677,"repo":"aboul3la/Sublist3r","listed_as":"aboul3la/Sublist3r","name":"Sublist3r","category":"penetration-testing","subcategory":"Penetration Testing","description":"Fast subdomains enumeration tool for penetration testers","license":"GPL-2.0","stars":11064,"archived":false,"last_commit":"2020-07-29T06:08:31Z","days_since_commit":2273,"release":{"tag":"1.1","date":"2020-04-06T18:37:52Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":48010677,"owner_id":7898559,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":178254323,"repo":"lanmaster53/recon-ng","listed_as":"lanmaster53/recon-ng","name":"Recon-ng","category":"penetration-testing","subcategory":"Penetration Testing","description":"Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.","license":"GPL-3.0","stars":6002,"archived":false,"last_commit":"2026-10-05T14:10:07Z","days_since_commit":14,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":178254323,"owner_id":2516395,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":894433723,"repo":"ASCIT31/Dark-Moon","listed_as":"ASCIT31/Dark-Moon","name":"Darkmoon","category":"penetration-testing","subcategory":"Penetration Testing","description":"Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.","license":"GPL-3.0","stars":1097,"archived":false,"last_commit":"2026-10-01T08:22:43Z","days_since_commit":18,"release":{"tag":"v1.5.0","date":"2026-09-25T10:32:57Z","assets":0,"verification":null},"weeks":[2,2,1,1,2,0,3,10,1,2,0,0,0,5,3,3,5,4,18,3,0,10,2,2,3,3,14,5,1,1,0,3,3,5,6,3,6,3,1,11,19,0,2,11,0,8,3,19,6,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":894433723,"owner_id":91746957,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":40262072,"repo":"EmpireProject/Empire","listed_as":"EmpireProject/Empire","name":"Empire","category":"penetration-testing","subcategory":"Penetration Testing","description":"Empire is a PowerShell and Python post-exploitation agent.","license":"BSD-3-Clause","stars":7850,"archived":true,"last_commit":"2019-08-01T01:57:47Z","days_since_commit":2636,"release":{"tag":"2.5","date":"2018-03-15T21:01:06Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":40262072,"owner_id":25492515,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}],"source":"awesome-cyber-security-tools"},{"id":950915,"repo":"urbanadventurer/WhatWeb","listed_as":"urbanadventurer/WhatWeb","name":"WhatWeb","category":"penetration-testing","subcategory":"Passive Information Gathering","description":"Next generation web scanner","license":"GPL-2.0","stars":6896,"archived":false,"last_commit":"2026-04-02T14:51:52Z","days_since_commit":200,"release":{"tag":"v0.6.4","date":"2026-04-02T15:43:24Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":950915,"owner_id":101783,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}],"source":"awesome-cyber-security-tools"},{"id":1212922,"repo":"laramies/theHarvester","listed_as":"laramies/theHarvester","name":"theHarvester","category":"penetration-testing","subcategory":"Passive Information Gathering","description":"E-mails, subdomains and names Harvester - OSINT ","license":"GPL-2.0","stars":18002,"archived":false,"last_commit":"2026-10-19T05:43:43Z","days_since_commit":0,"release":{"tag":"4.11.1","date":"2026-06-03T22:29:25Z","assets":0,"verification":null},"weeks":[3,2,2,6,2,7,7,5,8,5,5,7,5,2,3,5,3,11,5,0,1,2,18,13,10,10,4,9,9,17,4,10,5,10,11,1,1,7,37,46,56,41,51,36,3,5,3,1,3,0,1,3],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":1212922,"owner_id":543611,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":1173123,"repo":"darkoperator/dnsrecon","listed_as":"darkoperator/dnsrecon","name":"dnsrecon","category":"penetration-testing","subcategory":"Active Information Gathering","description":"DNS Enumeration Script","license":"GPL-2.0","stars":3083,"archived":false,"last_commit":"2026-10-09T09:07:49Z","days_since_commit":10,"release":{"tag":"1.6.3","date":"2026-06-28T23:46:01Z","assets":0,"verification":null},"weeks":[1,0,1,4,0,2,1,5,7,4,0,0,2,0,2,4,2,7,2,2,1,3,11,4,5,4,1,8,9,7,5,6,1,10,3,6,3,1,0,0,7,1,1,0,0,0,1,0,0,4,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":1173123,"owner_id":521246,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":15800479,"repo":"fwaeytens/dnsenum","listed_as":"fwaeytens/dnsenum","name":"dnsenum","category":"penetration-testing","subcategory":"Active Information Gathering","description":"dnsenum is a perl script that enumerates DNS information","license":"","stars":712,"archived":false,"last_commit":"2015-02-20T18:56:16Z","days_since_commit":4259,"release":{"tag":"1.2.4.2","date":"2015-02-20T18:58:37Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":15800479,"owner_id":1727544,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":8957117,"repo":"alexxy/netdiscover","listed_as":"alexxy/netdiscover","name":"Netdiscover","category":"penetration-testing","subcategory":"Active Information Gathering","description":"netdiscover","license":"GPL-3.0","stars":408,"archived":false,"last_commit":"2022-10-12T12:28:44Z","days_since_commit":1468,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":8957117,"owner_id":100408,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}],"source":"awesome-cyber-security-tools"},{"id":19788473,"repo":"EnableSecurity/wafw00f","listed_as":"EnableSecurity/wafw00f","name":"wafw00f","category":"penetration-testing","subcategory":"Active Information Gathering","description":"WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.","license":"BSD-3-Clause","stars":6578,"archived":false,"last_commit":"2026-04-19T12:47:41Z","days_since_commit":183,"release":{"tag":"v2.4.2","date":"2026-01-26T20:03:13Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,1,0,0,0,0,0,1,22,5,0,0,0,0,0,0,0,1,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":19788473,"owner_id":13013552,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}],"source":"awesome-cyber-security-tools"},{"id":30102273,"repo":"MobSF/Mobile-Security-Framework-MobSF","listed_as":"MobSF/Mobile-Security-Framework-MobSF","name":"MobSF","category":"penetration-testing","subcategory":"Mobile Penetration Testing","description":"Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.","license":"GPL-3.0","stars":21995,"archived":false,"last_commit":"2026-10-13T05:04:18Z","days_since_commit":6,"release":{"tag":"v4.5.3","date":"2026-09-21T02:52:26Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,3,1,0,0,0,0,0,1,0,0,0,0,0,0,2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,10,2,0,0,0,0,19,0,0,1,0],"advisories":[{"id":"GHSA-hh7q-v28p-p55m","cve":"","severity":"medium","published":"2026-09-21","summary":"Cross-Site Request Forgery via GET-based dynamic analysis actions"},{"id":"GHSA-m83p-3cgp-6p8c","cve":"","severity":"medium","published":"2026-09-21","summary":"Path traversal in iOS IPA icon extraction via unvalidated CFBundleExecutable allows restricted app/image read"},{"id":"GHSA-3fr8-jfgg-fm3x","cve":"","severity":"medium","published":"2026-09-21","summary":"Server-Side Request Forgery (SSRF) via X-Forwarded-Host Header in /httptools Endpoint"},{"id":"GHSA-cvhc-xjjc-c4p3","cve":"","severity":"low","published":"2026-09-21","summary":"Denial of service via APK decompression bomb in the bundled apkinspector ZIP reader"},{"id":"GHSA-c8g7-42qj-frj3","cve":"","severity":"medium","published":"2026-09-21","summary":"Windows-only path traversal via root-relative paths bypasses is_path_traversal()"},{"id":"GHSA-95px-34x5-p37h","cve":"CVE-2026-68927","severity":"low","published":"2026-07-05","summary":"SSRF port restriction bypass in assetlinks_check"},{"id":"GHSA-x768-8642-mmq9","cve":"CVE-2026-68924","severity":"medium","published":"2026-07-05","summary":"Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction"},{"id":"GHSA-3p54-567p-2wpr","cve":"CVE-2026-68923","severity":"medium","published":"2026-07-05","summary":"Regression: CSRF checks not enforced after Django migration"},{"id":"GHSA-8j49-mmcx-4mp5","cve":"CVE-2026-68922","severity":"medium","published":"2026-07-05","summary":"Arbitrary File Read via Path Traversal in ZIP Uploads"},{"id":"GHSA-hqjr-43r5-9q58","cve":"CVE-2026-33545","severity":"medium","published":"2026-03-21","summary":"SQL Injection in SQLite Database Viewer utils"},{"id":"GHSA-8hf7-h89p-3pqj","cve":"CVE-2026-24490","severity":"high","published":"2026-01-26","summary":"Stored XSS via Manifest Analysis - Dialer Code Host Field"},{"id":"GHSA-9gh8-9r95-3fc3","cve":"CVE-2025-58162","severity":"medium","published":"2025-08-31","summary":"Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction"},{"id":"GHSA-ccc3-fvfx-mw3v","cve":"CVE-2025-58161","severity":"low","published":"2025-08-31","summary":"Path Traversal in GET /download/<filename> using absolute filenames in MobSF data directory"},{"id":"GHSA-mwfg-948f-2cc5","cve":"CVE-2025-46335","severity":"medium","published":"2025-05-04","summary":"Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload"},{"id":"GHSA-c5vg-26p8-q8cr","cve":"CVE-2025-46730","severity":"medium","published":"2025-05-04","summary":"Web Server Resource Exhaustion via ZIP of Death Attack"},{"id":"GHSA-fcfq-m8p6-gw56","cve":"CVE-2025-31116","severity":"medium","published":"2025-03-29","summary":"SSRF on assetlinks_check with DNS Rebinding"},{"id":"GHSA-79f6-p65j-3m2m","cve":"CVE-2025-24805","severity":"high","published":"2025-02-05","summary":"Local Privilege escalation due to leaked REST API key in web UI"},{"id":"GHSA-jrm8-xgf3-fwqr","cve":"CVE-2025-24804","severity":"medium","published":"2025-02-05","summary":"Partial Denial of Service due to strict regex check in iOS report view URL"},{"id":"GHSA-cxqq-w3x5-7ph3","cve":"CVE-2025-24803","severity":"high","published":"2025-02-05","summary":"Stored Cross-Site Scripting in iOS dynamic_analysis view via `bundle` id"},{"id":"GHSA-5jc6-h9w7-jm3p","cve":"CVE-2024-53999","severity":"high","published":"2024-12-03","summary":"Stored Cross-Site Scripting Vulnerability in Recent Scans \"Diff or Compare\""}],"status":"active","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":30102273,"owner_id":25052637,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":3536659,"repo":"ReversecLabs/drozer","listed_as":"mwrlabs/drozer","name":"Drozer","category":"penetration-testing","subcategory":"Mobile Penetration Testing","description":"The Leading Security Assessment Framework for Android.","license":"other","stars":4640,"archived":false,"last_commit":"2026-04-08T07:54:54Z","days_since_commit":194,"release":{"tag":"3.1.0","date":"2024-08-01T17:36:09Z","assets":2,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,3,17,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"renamed","from":"mwrlabs/drozer","to":"ReversecLabs/drozer"},{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":3536659,"owner_id":207843805,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}],"source":"awesome-cyber-security-tools"},{"id":57376133,"repo":"dpnishant/appmon","listed_as":"dpnishant/appmon","name":"AppMon","category":"penetration-testing","subcategory":"Mobile Penetration Testing","description":"Documentation:","license":"Apache-2.0","stars":1633,"archived":true,"last_commit":"2022-11-08T15:47:37Z","days_since_commit":1441,"release":{"tag":"0.5","date":"2018-02-12T11:39:11Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T19:43:57Z","pin":{"id":57376133,"owner_id":1339669,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}],"source":"awesome-cyber-security-tools"},{"id":3766706,"repo":"iBotPeaches/Apktool","listed_as":"iBotPeaches/Apktool","name":"APKTool","category":"penetration-testing","subcategory":"Mobile Penetration Testing","description":"A tool for reverse engineering Android apk files","license":"Apache-2.0","stars":26229,"archived":false,"last_commit":"2026-10-17T10:44:10Z","days_since_commit":2,"release":{"tag":"v3.0.3","date":"2026-07-20T10:37:54Z","assets":1,"verification":"none"},"weeks":[2,1,1,3,1,1,4,3,1,0,1,2,3,2,7,3,0,6,2,1,0,0,1,6,3,2,3,1,3,0,0,0,0,2,1,0,0,0,5,2,2,3,1,2,5,0,2,2,1,2,6,0],"advisories":[{"id":"GHSA-m8mh-x359-vm8m","cve":"CVE-2026-39973","severity":"high","published":"2026-04-19","summary":"Path Traversal to Arbitrary File Write in Apktool 3.0.1 (Regression in commit e10a045)"},{"id":"GHSA-vgwr-4w3p-xmjv","cve":"","severity":"high","published":"2024-01-20","summary":"Write to arbitrary files while decoding on Windows"},{"id":"GHSA-2hqv-2xv4-5h5w","cve":"CVE-2024-21633","severity":"high","published":"2024-01-03","summary":"Arbitrary file write on Decoding"}],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":3766706,"owner_id":611784,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":23953531,"repo":"androguard/androguard","listed_as":"androguard/androguard","name":"AndroGuard","category":"penetration-testing","subcategory":"Mobile Penetration Testing","description":"Reverse engineering and pentesting for Android applications ","license":"Apache-2.0","stars":6363,"archived":false,"last_commit":"2026-10-12T13:18:57Z","days_since_commit":7,"release":{"tag":"v4.1.4","date":"2026-06-05T06:42:12Z","assets":2,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,5,5,0,1,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":23953531,"owner_id":8758456,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":67702184,"repo":"topjohnwu/Magisk","listed_as":"topjohnwu/Magisk","name":"Magisk","category":"penetration-testing","subcategory":"Mobile Penetration Testing","description":"The Magic Mask for Android","license":"GPL-3.0","stars":63368,"archived":false,"last_commit":"2026-10-16T14:00:19Z","days_since_commit":3,"release":{"tag":"v30.7","date":"2026-02-23T08:07:01Z","assets":3,"verification":"none"},"weeks":[1,3,2,1,6,15,7,1,1,0,0,5,4,1,7,1,0,4,56,5,16,4,5,7,8,16,2,0,1,0,1,1,1,0,1,1,2,0,3,15,3,5,15,18,49,1,10,4,10,53,9,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":67702184,"owner_id":7337301,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":3914697,"repo":"simsong/bulk_extractor","listed_as":"simsong/bulk_extractor","name":"Bulk Extractor","category":"digital-forensics","subcategory":"Digital Forensics","description":"This is the development tree. Production downloads are at:","license":"other","stars":1431,"archived":false,"last_commit":"2026-10-12T00:57:38Z","days_since_commit":7,"release":{"tag":"v2.2.0","date":"2026-08-18T10:20:24Z","assets":5,"verification":"checksum"},"weeks":[1,19,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,49,118,83,37,8,0,4,0,0,0,0,1,0,0],"advisories":[{"id":"GHSA-rh8m-9xrx-q64q","cve":"CVE-2026-24857","severity":"high","published":"2026-01-28","summary":"Heap-based Buffer Overflow in bulk_extractor"}],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T19:43:57Z","pin":{"id":3914697,"owner_id":1594284,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}],"source":"awesome-cyber-security-tools"},{"id":50709748,"repo":"mattifestation/CimSweep","listed_as":"PowerShellMafia/CimSweep","name":"CimSweep","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.","license":"BSD-3-Clause","stars":656,"archived":false,"last_commit":"2017-09-18T23:09:32Z","days_since_commit":3317,"release":{"tag":"v0.6.1.1","date":"2017-06-08T17:15:57Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"PowerShellMafia/CimSweep","to":"mattifestation/CimSweep"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":50709748,"owner_id":1781087,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":44545775,"repo":"opensourcesec/CIRTKit","listed_as":"byt3smith/CIRTKit","name":"CIRTkit","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Tools for the Computer Incident Response Team :computer:","license":"MIT","stars":153,"archived":false,"last_commit":"2017-04-17T16:43:44Z","days_since_commit":3472,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"byt3smith/CIRTKit","to":"opensourcesec/CIRTKit"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":44545775,"owner_id":26194022,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":1279470595,"repo":"cynative/cynative","listed_as":"cynative/cynative","name":"Cynative","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Open-source AI agent framework for cloud security across AWS, Azure, GCP and Kubernetes: AI-powered cloud detection and response, and cloud security posture management findings triage.","license":"Apache-2.0","stars":223,"archived":false,"last_commit":"2026-10-18T10:52:43Z","days_since_commit":1,"release":{"tag":"v1.14.0","date":"2026-10-13T13:02:41Z","assets":10,"verification":"signature"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,13,34,16,36,32,19,8,11,10,12,8,19,10,5,10,13,27,1],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":1279470595,"owner_id":260118153,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":516286996,"repo":"fox-it/dissect","listed_as":"fox-it/dissect","name":"Dissect","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).","license":"AGPL-3.0","stars":1173,"archived":false,"last_commit":"2026-10-07T09:48:59Z","days_since_commit":12,"release":{"tag":"3.22","date":"2026-02-26T16:12:00Z","assets":0,"verification":null},"weeks":[0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":516286996,"owner_id":468621,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":56880352,"repo":"mwielgoszewski/doorman","listed_as":"mwielgoszewski/doorman","name":"Doorman","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"an osquery fleet manager","license":"MIT","stars":621,"archived":false,"last_commit":"2019-01-05T02:29:07Z","days_since_commit":2844,"release":{"tag":"v0.6","date":"2017-09-05T11:48:19Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":56880352,"owner_id":359029,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":96361940,"repo":"mandiant/flare-vm","listed_as":"fireeye/flare-vm","name":"Flare","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.","license":"Apache-2.0","stars":9160,"archived":false,"last_commit":"2026-10-07T14:43:05Z","days_since_commit":12,"release":{"tag":"vbox-1.0.0","date":"2025-08-13T16:58:51Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,3,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"fireeye/flare-vm","to":"mandiant/flare-vm"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":96361940,"owner_id":331209,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":309820286,"repo":"fleetdm/fleet","listed_as":"fleetdm/fleet","name":"Fleetdm","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Open device management","license":"other","stars":7012,"archived":false,"last_commit":"2026-10-19T22:18:52Z","days_since_commit":0,"release":{"tag":"fleet-v4.93.0","date":"2026-10-08T15:02:25Z","assets":15,"verification":"checksum"},"weeks":[135,156,191,245,166,238,209,228,56,56,188,170,173,242,244,220,277,338,257,314,288,207,253,253,160,301,221,270,276,236,226,293,246,224,254,182,250,221,209,239,253,193,229,155,229,255,224,217,179,303,167,54],"advisories":[{"id":"GHSA-x467-vgxf-2g6h","cve":"","severity":"high","published":"2026-10-02","summary":"Unauthenticated denial of service via unbounded recursion in Apple MDM enrollment property list parsing"},{"id":"GHSA-3982-g48v-9rwh","cve":"","severity":"high","published":"2026-10-02","summary":"Unbounded gzip decompression of request bodies allows unauthenticated denial of service"},{"id":"GHSA-vrc8-2wcx-327f","cve":"","severity":"critical","published":"2026-09-15","summary":"Unauthenticated iOS/iPadOS device API access via non-secret host identifiers"},{"id":"GHSA-97fg-h5wh-2399","cve":"","severity":"medium","published":"2026-09-14","summary":"Team-scoped users can read MDM command results for hosts on other teams via shared command UUID"},{"id":"GHSA-fv3p-h7wv-2jgm","cve":"","severity":"high","published":"2026-09-11","summary":"OS command injection via Homebrew cask metadata in Fleet-maintained app install and uninstall scripts"},{"id":"GHSA-7q96-f8xw-jv5j","cve":"CVE-2026-54245","severity":"critical","published":"2026-08-11","summary":"SQL injection in Okta conditional access policy evaluation allows an enrolled host to compromise the Fleet database"},{"id":"GHSA-88p2-jj8w-j8qg","cve":"CVE-2026-48786","severity":"medium","published":"2026-08-11","summary":"Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint"},{"id":"GHSA-rxhg-vcww-2mpw","cve":"","severity":"low","published":"2026-08-11","summary":"ORDER BY column injection on activity list endpoints"},{"id":"GHSA-q9c5-pp7m-fm2g","cve":"","severity":"medium","published":"2026-08-11","summary":"Unauthenticated download of in-house iOS app binaries via predictable URLs"},{"id":"GHSA-gm7f-v959-fr2g","cve":"CVE-2026-41262","severity":"medium","published":"2026-06-26","summary":"Cross-Team Policy Data Exposure via Global Policy Read Endpoint"},{"id":"GHSA-x4qr-qw6h-wvxq","cve":"CVE-2026-46371","severity":"medium","published":"2026-06-11","summary":"Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint"},{"id":"GHSA-vxm7-9x8v-8gm4","cve":"CVE-2026-46370","severity":"medium","published":"2026-06-11","summary":"Observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint"},{"id":"GHSA-mxmp-wr3w-rvqx","cve":"CVE-2026-46356","severity":"medium","published":"2026-05-13","summary":"IP spoofing allows bypassing API rate limiting"},{"id":"GHSA-9vcr-g537-3w5v","cve":"CVE-2026-26191","severity":"high","published":"2026-05-13","summary":"OS command injection in software packages"},{"id":"GHSA-x67p-9m2r-fxqv","cve":"CVE-2026-26062","severity":"high","published":"2026-05-13","summary":"Fleet server may terminate unexpectedly when handling certain gRPC requests"},{"id":"GHSA-ffg9-j72f-j6xm","cve":"CVE-2026-24899","severity":"high","published":"2026-05-13","summary":"Fleet Windows MDM Azure AD JWT authentication bypass"},{"id":"GHSA-j8h8-75h3-jg53","cve":"CVE-2026-24000","severity":"medium","published":"2026-05-13","summary":" Rate limiting bypass via untrusted client IP headers"},{"id":"GHSA-2rc4-7jc6-qffh","cve":"CVE-2026-23998","severity":"high","published":"2026-05-13","summary":"Windows MDM management endpoint authentication bypass"},{"id":"GHSA-rphv-h674-5hp2","cve":"CVE-2026-27806","severity":"high","published":"2026-04-08","summary":"Local Privilege Escalation via Tcl Command Injection in Orbit"},{"id":"GHSA-7rhw-5mpv-gp4h","cve":"CVE-2026-34387","severity":"high","published":"2026-03-27","summary":"OS command injection via crafted software package metadata in uninstall scripts"}],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":309820286,"owner_id":70264713,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":14909673,"repo":"google/grr","listed_as":"google/grr","name":"GRR Rapid Response","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"GRR Rapid Response: remote live forensics for incident response","license":"Apache-2.0","stars":5092,"archived":false,"last_commit":"2026-10-01T16:04:33Z","days_since_commit":18,"release":{"tag":"v.4.0.0.0-release","date":"2025-12-15T17:12:33Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,2,6,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,2,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":14909673,"owner_id":1342004,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":440092871,"repo":"dfir-iris/iris-web","listed_as":"dfir-iris/iris-web","name":"IRIS","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Collaborative Incident Response platform","license":"LGPL-3.0","stars":1596,"archived":false,"last_commit":"2026-09-23T14:42:16Z","days_since_commit":26,"release":{"tag":"v2.4.29","date":"2026-08-10T08:13:13Z","assets":0,"verification":null},"weeks":[30,31,44,50,1,1,0,0,0,7,0,10,2,0,0,2,3,1,3,1,1,3,2,4,3,3,0,0,0,1,0,0,0,0,70,40,16,24,8,1,0,0,0,2,2,0,10,15,0,0,0,0],"advisories":[{"id":"GHSA-w746-jjv4-fw8v","cve":"","severity":"medium","published":"2026-10-02","summary":"Improper Neutralization of Alternate XSS Syntax in iris-web "},{"id":"GHSA-3mxh-x92q-9r25","cve":"CVE-2026-41522","severity":"high","published":"2026-05-28","summary":"Improper Authorization in iris-web"},{"id":"GHSA-8hwq-v6vm-9grr","cve":"CVE-2026-42547","severity":"medium","published":"2026-05-28","summary":"Alerts Can be Falsely Attributed to Customers"},{"id":"GHSA-m73w-v4r5-vw9m","cve":"CVE-2026-42543","severity":"medium","published":"2026-05-28","summary":"Cross-Site Request Forgery (CSRF)"},{"id":"GHSA-w78h-mx7h-qm3h","cve":"CVE-2026-42540","severity":"medium","published":"2026-05-28","summary":"Mass Assignment"},{"id":"GHSA-g588-5gmf-p5cx","cve":"CVE-2026-42539","severity":"medium","published":"2026-05-28","summary":"Excessive Data Exposure"},{"id":"GHSA-m624-7744-2mhf","cve":"CVE-2026-42538","severity":"medium","published":"2026-05-28","summary":"Insecure File Upload"},{"id":"GHSA-vjc3-7jwv-j9qf","cve":"CVE-2026-42329","severity":"medium","published":"2026-05-28","summary":"Open Redirect"},{"id":"GHSA-qhqj-8qw6-wp8v","cve":"CVE-2026-22783","severity":"critical","published":"2026-01-11","summary":"Arbitrary File Deletion via Mass Assignment in Datastore File Management"},{"id":"GHSA-m64w-f7fg-hpcr","cve":"CVE-2024-25624","severity":"high","published":"2024-04-25","summary":"Server Side Template Injection in reports"},{"id":"GHSA-2xq6-qc74-w5vp","cve":"CVE-2024-25640","severity":"medium","published":"2024-02-18","summary":"Improper Neutralization of Alternate XSS Syntax in iris-web"},{"id":"GHSA-593r-747g-p92p","cve":"CVE-2023-50712","severity":"medium","published":"2023-12-18","summary":"Improper Neutralization of Alternate XSS Syntax in iris-web "},{"id":"GHSA-gc6j-6276-2m49","cve":"CVE-2023-30615","severity":"medium","published":"2023-05-24","summary":"Improper Neutralization of Script-Related HTML Tags in Web Pages (Basic XSS) in iris-web"}],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":440092871,"owner_id":95911680,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":218914740,"repo":"DFIRKuiper/Kuiper","listed_as":"DFIRKuiper/Kuiper","name":"Kuiper","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Digital Forensics Investigation Platform","license":"","stars":909,"archived":false,"last_commit":"2024-10-12T07:48:11Z","days_since_commit":737,"release":{"tag":"v2.3.5","date":"2023-11-18T20:08:08Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":218914740,"owner_id":57226344,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":510034344,"repo":"matanolabs/matano","listed_as":"matanolabs/matano","name":"Matano","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS","license":"Apache-2.0","stars":1699,"archived":false,"last_commit":"2025-01-08T03:50:17Z","days_since_commit":649,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":510034344,"owner_id":108618919,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":16940917,"repo":"mozilla/MozDef","listed_as":"mozilla/MozDef","name":"MozDef","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"DEPRECATED - MozDef: Mozilla Enterprise Defense Platform","license":"MPL-2.0","stars":2158,"archived":true,"last_commit":"2021-11-02T16:41:59Z","days_since_commit":1812,"release":{"tag":"v3.1.2","date":"2019-10-04T16:40:07Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":16940917,"owner_id":131524,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":470128313,"repo":"MutableSecurity/mutablesecurity","listed_as":"MutableSecurity/mutablesecurity","name":"MutableSecurity","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"CLI program for automating the setup, configuration, and use of cybersecurity solutions","license":"MIT","stars":50,"archived":true,"last_commit":"2023-02-12T16:28:54Z","days_since_commit":1345,"release":{"tag":"v0.4.0","date":"2022-10-22T06:26:56Z","assets":2,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":470128313,"owner_id":93042793,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":62714540,"repo":"biggiesmallsAG/nightHawkResponse","listed_as":"biggiesmallsAG/nightHawkResponse","name":"nightHawk","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Incident Response Forensic Framework","license":"","stars":607,"archived":false,"last_commit":"2019-11-20T01:13:44Z","days_since_commit":2525,"release":{"tag":"1.0.3","date":"2016-09-01T06:26:43Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":62714540,"owner_id":17421028,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":584842800,"repo":"zdhenard42/SOC-Multitool","listed_as":"zdhenard42/SOC-Multitool","name":"SOC Multi-tool","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"A powerful and user-friendly browser extension that streamlines investigations for security professionals.","license":"MIT","stars":422,"archived":false,"last_commit":"2025-05-13T20:52:57Z","days_since_commit":524,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":584842800,"owner_id":104698652,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":1227974892,"repo":"ridgelinecyberdefence/vanguard","listed_as":"ridgelinecyberdefence/vanguard","name":"VanGuard","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensics, disk collection, remote operations, and Velociraptor management. Works air-gapped, with automated timeline generation.","license":"MIT","stars":158,"archived":false,"last_commit":"2026-07-28T22:24:07Z","days_since_commit":82,"release":{"tag":"v1.0.1","date":"2026-07-06T12:14:32Z","assets":3,"verification":"checksum"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,0,1,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1227974892,"owner_id":252557331,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":126576769,"repo":"Velocidex/velociraptor","listed_as":"Velocidex/velociraptor","name":"Velociraptor","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Digging Deeper....","license":"other","stars":4357,"archived":false,"last_commit":"2026-10-17T13:17:26Z","days_since_commit":2,"release":{"tag":"v0.77.3","date":"2026-10-05T01:00:38Z","assets":25,"verification":"signature"},"weeks":[5,4,11,1,4,4,6,2,2,6,34,6,2,2,5,7,2,10,10,12,12,6,3,5,3,8,7,6,2,7,6,5,8,9,5,0,0,5,8,7,19,8,3,2,3,4,12,7,8,13,7,0],"advisories":[{"id":"GHSA-9qq5-422f-33c2","cve":"CVE-2026-85737","severity":"medium","published":"2026-08-25","summary":"Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin"}],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":126576769,"owner_id":36671444,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":44610249,"repo":"zentralopensource/zentral","listed_as":"zentralopensource/zentral","name":"Zentral","category":"incident-response","subcategory":"All-In-One Tools","source":"awesome-incident-response","description":"Zentral is a control plane for secure, observable Apple endpoints in enterprises. Configure, observe, and enforce the desired state of every Apple endpoint. Manage that desired state as code through GitOps and Terraform.","license":"other","stars":887,"archived":false,"last_commit":"2026-10-16T09:40:33Z","days_since_commit":3,"release":{"tag":"v2026.5","date":"2026-08-21T13:38:51Z","assets":0,"verification":null},"weeks":[5,15,7,7,5,16,21,7,4,3,8,11,10,2,21,8,13,7,11,2,1,15,2,11,3,2,2,0,31,34,35,26,13,7,0,15,12,6,15,23,40,48,55,60,24,20,25,23,8,7,8,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":44610249,"owner_id":15214771,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":515986949,"repo":"fox-it/acquire","listed_as":"fox-it/acquire","name":"Acquire","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.","license":"AGPL-3.0","stars":121,"archived":false,"last_commit":"2026-08-12T10:24:33Z","days_since_commit":68,"release":{"tag":"3.22","date":"2026-02-26T12:30:23Z","assets":0,"verification":null},"weeks":[0,0,0,1,1,0,1,1,0,0,0,1,0,0,0,3,1,1,0,1,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":515986949,"owner_id":468621,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":231612840,"repo":"forensicanalysis/artifactcollector","listed_as":"forensicanalysis/artifactcollector","name":"artifactcollector","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"🧭 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system","license":"MIT","stars":308,"archived":true,"last_commit":"2025-05-07T19:06:45Z","days_since_commit":530,"release":{"tag":"v0.17.1","date":"2024-10-19T12:58:28Z","assets":5,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":231612840,"owner_id":57172090,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":49660976,"repo":"orlikoski/CDQR","listed_as":"rough007/CDQR","name":"Cold Disk Quick Response","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices","license":"GPL-3.0","stars":346,"archived":false,"last_commit":"2019-12-26T17:15:40Z","days_since_commit":2489,"release":{"tag":"20191226","date":"2019-12-26T17:19:14Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"rough007/CDQR","to":"orlikoski/CDQR"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":49660976,"owner_id":9388572,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":67550752,"repo":"orlikoski/CyLR","listed_as":"orlikoski/CyLR","name":"CyLR","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"CyLR - Live Response Collection Tool","license":"GPL-3.0","stars":736,"archived":false,"last_commit":"2021-10-12T19:27:03Z","days_since_commit":1833,"release":{"tag":"2.2.0","date":"2021-02-03T16:50:54Z","assets":4,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":67550752,"owner_id":9388572,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":26029828,"repo":"ForensicArtifacts/artifacts","listed_as":"ForensicArtifacts/artifacts","name":"Forensic Artifacts","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"Digital Forensics artifact repository","license":"Apache-2.0","stars":1282,"archived":false,"last_commit":"2026-09-27T09:07:31Z","days_since_commit":22,"release":{"tag":"20260127","date":"2026-01-27T05:44:22Z","assets":2,"verification":"signature"},"weeks":[0,0,0,2,2,0,0,0,1,0,0,0,1,1,2,1,0,0,0,0,0,0,0,1,1,2,1,2,3,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,1,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":26029828,"owner_id":3381114,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":64792339,"repo":"diogo-fernan/ir-rescue","listed_as":"diogo-fernan/ir-rescue","name":"ir-rescue","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.","license":"other","stars":489,"archived":false,"last_commit":"2021-02-21T09:23:23Z","days_since_commit":2066,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":64792339,"owner_id":11231644,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":65315497,"repo":"ThreatResponse/margaritashotgun","listed_as":"ThreatResponse/margaritashotgun","name":"Margarita Shotgun","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"Remote Memory Acquisition Tool ","license":"MIT","stars":253,"archived":false,"last_commit":"2018-06-19T16:36:32Z","days_since_commit":3044,"release":{"tag":"v0.4.1","date":"2017-07-21T03:38:35Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":65315497,"owner_id":19498742,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":636350744,"repo":"alpine-sec/SPECTR3","listed_as":"alpine-sec/SPECTR3","name":"SPECTR3","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.","license":"LGPL-3.0","stars":44,"archived":false,"last_commit":"2024-10-25T07:55:25Z","days_since_commit":724,"release":{"tag":"v0.7.7","date":"2024-10-25T08:03:13Z","assets":3,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":636350744,"owner_id":116924737,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":232617828,"repo":"tclahr/uac","listed_as":"tclahr/uac","name":"UAC","category":"incident-response","subcategory":"Evidence Collection","source":"awesome-incident-response","description":"UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.","license":"Apache-2.0","stars":1491,"archived":false,"last_commit":"2026-09-09T11:11:43Z","days_since_commit":40,"release":{"tag":"v3.4.0","date":"2026-09-09T11:12:55Z","assets":2,"verification":"checksum"},"weeks":[0,6,4,0,3,0,0,0,1,0,0,12,6,4,1,3,3,1,4,3,1,5,0,1,4,1,0,0,0,0,4,0,1,0,0,2,0,0,1,3,0,0,4,2,2,4,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":232617828,"owner_id":20645243,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":437681627,"repo":"SecurityBrewery/catalyst","listed_as":"SecurityBrewery/catalyst","name":"Catalyst","category":"incident-response","subcategory":"Incident Management","source":"awesome-incident-response","description":"⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes","license":"AGPL-3.0","stars":537,"archived":true,"last_commit":"2026-07-18T08:06:59Z","days_since_commit":93,"release":{"tag":"v0.15.7","date":"2026-01-11T23:03:38Z","assets":6,"verification":"checksum"},"weeks":[3,0,0,0,2,0,0,0,8,0,0,1,0,0,0,1,0,1,0,0,0,1,0,2,0,1,0,0,3,0,0,0,0,0,0,0,3,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":437681627,"owner_id":93085090,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":64484320,"repo":"log2timeline/dftimewolf","listed_as":"log2timeline/dftimewolf","name":"DFTimewolf","category":"incident-response","subcategory":"Incident Management","source":"awesome-incident-response","description":"A framework for orchestrating forensic collection, processing and data export","license":"Apache-2.0","stars":360,"archived":false,"last_commit":"2026-10-01T03:03:57Z","days_since_commit":18,"release":null,"weeks":[0,1,0,0,0,1,1,4,0,0,3,3,2,1,0,1,1,0,1,3,4,0,0,4,2,0,2,6,3,3,3,2,0,1,1,1,0,3,1,0,0,3,4,1,1,0,4,1,4,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":64484320,"owner_id":8701971,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":157126399,"repo":"dfirtrack/dfirtrack","listed_as":"dfirtrack/dfirtrack","name":"DFIRTrack","category":"incident-response","subcategory":"Incident Management","source":"awesome-incident-response","description":"DFIRTrack - The Incident Response Tracking Application","license":"other","stars":540,"archived":false,"last_commit":"2026-01-13T14:47:07Z","days_since_commit":279,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,3,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":157126399,"owner_id":85190025,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":32028167,"repo":"certsocietegenerale/FIR","listed_as":"certsocietegenerale/FIR","name":"Fast Incident Response (FIR)","category":"incident-response","subcategory":"Incident Management","source":"awesome-incident-response","description":"Fast Incident Response","license":"GPL-3.0","stars":2046,"archived":false,"last_commit":"2026-09-13T19:59:08Z","days_since_commit":36,"release":{"tag":"django4","date":"2022-09-13T07:37:07Z","assets":0,"verification":null},"weeks":[1,0,0,0,0,2,2,0,1,0,7,2,0,0,0,6,4,0,1,0,0,1,6,4,0,0,8,1,0,0,0,1,1,0,0,0,0,4,21,1,2,0,0,0,2,1,1,0,0,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":32028167,"owner_id":4599115,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":23404197,"repo":"sandialabs/scot","listed_as":"sandialabs/scot","name":"Sandia Cyber Omni Tracker (SCOT)","category":"incident-response","subcategory":"Incident Management","source":"awesome-incident-response","description":"Sandia Cyber Omni Tracker (SCOT)","license":"other","stars":254,"archived":false,"last_commit":"2024-11-04T14:36:39Z","days_since_commit":714,"release":{"tag":"v3.20.0","date":"2022-08-15T22:30:41Z","assets":2,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":23404197,"owner_id":4993680,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":262044260,"repo":"Shuffle/Shuffle","listed_as":"frikky/Shuffle","name":"Shuffle","category":"incident-response","subcategory":"Incident Management","source":"awesome-incident-response","description":"Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.","license":"AGPL-3.0","stars":2459,"archived":false,"last_commit":"2026-09-28T14:41:32Z","days_since_commit":21,"release":{"tag":"v2.3.0","date":"2026-09-28T13:57:49Z","assets":0,"verification":null},"weeks":[20,10,19,6,15,35,6,7,3,0,6,13,8,6,1,41,0,6,2,4,6,6,1,6,8,2,6,15,20,0,3,3,1,0,4,3,3,11,15,5,7,14,3,8,18,23,16,26,4,0,0,0],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"frikky/Shuffle","to":"Shuffle/Shuffle"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":262044260,"owner_id":74708781,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":41309236,"repo":"DefensePointSecurity/threat_note","listed_as":"defpoint/threat_note","name":"threatnote","category":"incident-response","subcategory":"Incident Management","source":"awesome-incident-response","description":"DPS' Lightweight Investigation Notebook","license":"Apache-2.0","stars":432,"archived":true,"last_commit":"2023-12-31T20:47:54Z","days_since_commit":1023,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"renamed","from":"defpoint/threat_note","to":"DefensePointSecurity/threat_note"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":41309236,"owner_id":5631315,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":50354664,"repo":"SekoiaLab/Fastir_Collector_Linux","listed_as":"SekoiaLab/Fastir_Collector_Linux","name":"FastIR Collector Linux","category":"incident-response","subcategory":"Linux Evidence Collection","source":"awesome-incident-response","description":"","license":"GPL-3.0","stars":177,"archived":false,"last_commit":"2021-01-26T08:20:51Z","days_since_commit":2092,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":50354664,"owner_id":6544502,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":548548806,"repo":"MagnetForensics/dumpit-linux","listed_as":"MagnetForensics/dumpit-linux","name":"MAGNET DumpIt","category":"incident-response","subcategory":"Linux Evidence Collection","source":"awesome-incident-response","description":"Memory acquisition for Linux that makes sense.","license":"Apache-2.0","stars":253,"archived":false,"last_commit":"2023-11-21T13:20:21Z","days_since_commit":1063,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":548548806,"owner_id":100233859,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":87005580,"repo":"mbevilacqua/appcompatprocessor","listed_as":"mbevilacqua/appcompatprocessor","name":"AppCompatProcessor","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"\"Evolving AppCompat/AmCache data analysis beyond grep\"","license":"Apache-2.0","stars":215,"archived":false,"last_commit":"2020-06-12T13:59:14Z","days_since_commit":2320,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":87005580,"owner_id":5233653,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":324641073,"repo":"ahmedkhlief/APT-Hunter","listed_as":"ahmedkhlief/APT-Hunter","name":"APT Hunter","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity","license":"GPL-3.0","stars":1430,"archived":false,"last_commit":"2026-09-20T08:40:16Z","days_since_commit":29,"release":{"tag":"V4.0","date":"2026-09-20T13:51:23Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":324641073,"owner_id":24752712,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":395658506,"repo":"WithSecureOpenSource/chainsaw","listed_as":"countercept/chainsaw","name":"Chainsaw","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"Rapidly Search and Hunt through Windows Forensic Artefacts","license":"GPL-3.0","stars":3694,"archived":false,"last_commit":"2026-10-14T17:46:19Z","days_since_commit":5,"release":{"tag":"v2.17.1","date":"2026-10-14T17:48:47Z","assets":7,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,3,3,0,1,4,0,1,0,7,1,0,0,0,0,0,0,0,0,4,2,0,5,3,0,3,2,0,0,0,3,0,0,9,0],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"countercept/chainsaw","to":"WithSecureOpenSource/chainsaw"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":395658506,"owner_id":153181904,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":296518768,"repo":"Yamato-Security/hayabusa","listed_as":"Yamato-Security/hayabusa","name":"Hayabusa","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.","license":"AGPL-3.0","stars":3406,"archived":false,"last_commit":"2026-10-13T02:27:42Z","days_since_commit":6,"release":{"tag":"v4.2.0","date":"2026-10-13T02:50:43Z","assets":13,"verification":"none"},"weeks":[3,11,13,1,0,5,2,0,0,0,0,0,1,10,2,0,1,1,0,0,0,0,0,0,0,0,9,4,0,0,0,0,0,7,11,69,58,42,16,12,1,0,4,2,3,5,0,4,1,0,4,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":296518768,"owner_id":72480401,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":10826666,"repo":"jensvoid/lorg","listed_as":"jensvoid/lorg","name":"Lorg","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"Apache Logfile Security Analyzer","license":"GPL-2.0","stars":215,"archived":false,"last_commit":"2019-02-22T09:29:11Z","days_since_commit":2796,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":10826666,"owner_id":4751530,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":82487586,"repo":"dogoncouch/logdissect","listed_as":"dogoncouch/logdissect","name":"Logdissect","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"CLI utility and Python module for analyzing log files and other data.","license":"MIT","stars":161,"archived":false,"last_commit":"2024-08-07T20:14:50Z","days_since_commit":803,"release":{"tag":"v3.1.1","date":"2018-04-07T19:50:39Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":82487586,"owner_id":25712949,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":1143604340,"repo":"bad-antics/nullsec-logreaper","listed_as":"bad-antics/nullsec-logreaper","name":"NullSec LogReaper","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit","license":"MIT","stars":83,"archived":false,"last_commit":"2026-04-16T04:43:53Z","days_since_commit":186,"release":{"tag":"v1.1.0","date":"2026-03-21T17:05:07Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,4,0,2,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":1143604340,"owner_id":160459796,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":111882253,"repo":"JPCERTCC/LogonTracer","listed_as":"JPCERTCC/LogonTracer","name":"LogonTracer","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"Investigate malicious Windows logon by visualizing and analyzing Windows event log","license":"other","stars":3291,"archived":false,"last_commit":"2026-08-02T02:31:30Z","days_since_commit":78,"release":{"tag":"v2.0.0","date":"2026-04-22T15:21:00Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":111882253,"owner_id":6404804,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":77276660,"repo":"SigmaHQ/sigma","listed_as":"SigmaHQ/sigma","name":"Sigma","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"Main Sigma Rule Repository","license":"other","stars":11288,"archived":false,"last_commit":"2026-10-19T11:01:37Z","days_since_commit":0,"release":{"tag":"r2026-07-01","date":"2026-07-09T14:51:34Z","assets":5,"verification":"none"},"weeks":[35,20,17,22,49,14,23,2,6,6,1,2,21,13,5,6,1,10,12,2,1,0,25,0,2,14,65,3,0,2,0,0,21,6,9,41,11,4,5,8,4,3,9,0,14,1,2,19,13,3,25,22],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":77276660,"owner_id":79842123,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":79683936,"repo":"airbnb/streamalert","listed_as":"airbnb/streamalert","name":"StreamAlert","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.","license":"Apache-2.0","stars":2892,"archived":false,"last_commit":"2022-07-20T20:54:36Z","days_since_commit":1552,"release":{"tag":"v3.5.0","date":"2021-11-04T19:07:51Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":79683936,"owner_id":698437,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":143079900,"repo":"JPCERTCC/SysmonSearch","listed_as":"JPCERTCC/SysmonSearch","name":"SysmonSearch","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"Investigate suspicious activity by visualizing Sysmon's event log","license":"other","stars":432,"archived":false,"last_commit":"2023-12-22T05:30:48Z","days_since_commit":1032,"release":{"tag":"v2.0","date":"2020-04-30T02:37:29Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":143079900,"owner_id":6404804,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":945007299,"repo":"Yamato-Security/WELA","listed_as":"Yamato-Security/WELA","name":"WELA","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.","license":"MIT","stars":125,"archived":false,"last_commit":"2026-10-01T23:48:25Z","days_since_commit":17,"release":{"tag":"v2.1.0","date":"2026-02-13T00:33:04Z","assets":0,"verification":null},"weeks":[7,13,21,12,7,7,7,7,7,7,7,7,7,7,6,10,7,7,7,7,7,7,7,7,7,7,7,8,7,7,1,1,0,0,0,4,0,0,0,1,0,0,0,0,8,0,13,0,1,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":945007299,"owner_id":72480401,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":343939740,"repo":"wagga40/Zircolite","listed_as":"wagga40/Zircolite","name":"Zircolite","category":"incident-response","subcategory":"Log Analysis Tools","source":"awesome-incident-response","description":"A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs","license":"other","stars":863,"archived":false,"last_commit":"2026-10-19T13:45:37Z","days_since_commit":0,"release":{"tag":"v4.6.0","date":"2026-10-18T15:08:26Z","assets":6,"verification":"checksum"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,8,5,4,8,3,6,4,1,2,3,1,2,0,0,0,0,2,2,6,0,0,0,0,0,0,0,13,33,29,0,0,1,0,1,29,52,27,148,29,20],"advisories":[{"id":"GHSA-vhhg-j629-5552","cve":"","severity":"medium","published":"2026-10-03","summary":"Rich markup injection from evidence content aborts a Zircolite run and spoofs console output"},{"id":"GHSA-9vjj-w2rg-2m48","cve":"","severity":"medium","published":"2026-10-03","summary":"Split field names taken from log values overwrite event fields and row_id (detection evasion, analysis denial of service)"},{"id":"GHSA-f5jh-7mx7-wwrq","cve":"","severity":"medium","published":"2026-10-03","summary":"ZircoGui data template lets a log field override the rule title, level, file and description"},{"id":"GHSA-r5c4-46jg-wgjh","cve":"","severity":"medium","published":"2026-10-03","summary":"DOM XSS in the bundled ZircoGui (Mini-GUI) via log-controlled field names, values and titles"},{"id":"GHSA-42q5-fmjv-w4px","cve":"","severity":"medium","published":"2026-10-03","summary":"Unbounded regex backtracking in the SQLite `regexp` function lets one crafted log line stall a Zircolite run (ReDoS)"},{"id":"GHSA-2hq2-3w3j-6pc9","cve":"","severity":"low","published":"2026-10-03","summary":"--generate-config follows a symlink planted at the output path (check-then-open TOCTOU)"},{"id":"GHSA-95jp-m2hj-j5mf","cve":"","severity":"low","published":"2026-10-03","summary":"CSV formula injection through the header row of `--csv` detection reports"},{"id":"GHSA-q2qh-vgfr-h3q9","cve":"","severity":"low","published":"2026-10-03","summary":"Quadratic regex backtracking in auditd line parsing (ReDoS)"},{"id":"GHSA-rxv3-q96p-qqwh","cve":"","severity":"low","published":"2026-10-03","summary":"7-Zip log-type auto-detection decompresses the whole first member into memory (decompression bomb)"},{"id":"GHSA-f8r2-xpcw-c4gh","cve":"","severity":"low","published":"2026-10-03","summary":"Archive password can only be passed on the command line, exposing it to other local users"},{"id":"GHSA-m3h8-pcx6-6wqx","cve":"","severity":"high","published":"2026-10-03","summary":"Transform sandbox escape: config-supplied transform code runs with full interpreter privileges"}],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":343939740,"owner_id":6437862,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":190660866,"repo":"microsoft/avml","listed_as":"microsoft/avml","name":"AVML","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"AVML - Acquire Volatile Memory for Linux","license":"MIT","stars":1124,"archived":false,"last_commit":"2026-10-19T21:59:10Z","days_since_commit":0,"release":{"tag":"v0.21.0","date":"2026-10-09T18:56:06Z","assets":8,"verification":"none"},"weeks":[0,4,0,0,0,0,0,0,0,0,0,0,0,0,6,0,6,1,4,0,3,0,0,0,2,1,3,2,1,25,1,0,12,4,0,3,9,1,4,0,0,14,2,0,0,0,0,4,1,5,1,3],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":190660866,"owner_id":6154722,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":33903622,"repo":"JamesHabben/evolve","listed_as":"JamesHabben/evolve","name":"Evolve","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"Web interface for the Volatility Memory Forensics Framework","license":"","stars":258,"archived":false,"last_commit":"2017-11-21T00:38:21Z","days_since_commit":3254,"release":{"tag":"v1.6","date":"2017-11-16T05:04:34Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":33903622,"owner_id":6327329,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":1679379,"repo":"ShaneK2/inVtero.net","listed_as":"ShaneK2/inVtero.net","name":"inVtero.net","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance.  Includes offensive & defensive memory capabilities.  Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques","license":"AGPL-3.0","stars":296,"archived":false,"last_commit":"2023-09-30T08:02:20Z","days_since_commit":1115,"release":{"tag":"CORE-0.1","date":"2017-08-28T06:52:58Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1679379,"owner_id":758286,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":24379459,"repo":"jtsylve/LiME","listed_as":"504ensicsLabs/LiME","name":"LiME","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory capt","license":"GPL-2.0","stars":2051,"archived":false,"last_commit":"2026-04-05T13:42:43Z","days_since_commit":197,"release":{"tag":"v1.12.0","date":"2026-03-31T14:21:08Z","assets":0,"verification":null},"weeks":[0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,1,16,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"renamed","from":"504ensicsLabs/LiME","to":"jtsylve/LiME"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":24379459,"owner_id":594165,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":182596189,"repo":"JPCERTCC/MalConfScan","listed_as":"JPCERTCC/MalConfScan","name":"MalConfScan","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"Volatility plugin for extracts configuration data of known malware","license":"other","stars":498,"archived":false,"last_commit":"2023-12-22T05:42:39Z","days_since_commit":1032,"release":{"tag":"v1.0.5","date":"2021-08-31T00:32:53Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":182596189,"owner_id":6404804,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":264956942,"repo":"LDO-CERT/orochi","listed_as":"LDO-CERT/orochi","name":"Orochi","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"The Volatility Collaborative GUI","license":"MIT","stars":278,"archived":false,"last_commit":"2026-09-10T10:02:00Z","days_since_commit":39,"release":{"tag":"v.2.5.0","date":"2026-09-10T11:21:15Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,37,25,0,0,0,0,2,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":264956942,"owner_id":31510459,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":19114225,"repo":"volatilityfoundation/volatility","listed_as":"volatilityfoundation/volatility","name":"Volatility","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"An advanced memory forensics framework","license":"GPL-2.0","stars":8052,"archived":true,"last_commit":"2025-05-16T13:40:55Z","days_since_commit":521,"release":{"tag":"2.6.1","date":"2024-04-09T20:04:28Z","assets":5,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":19114225,"owner_id":6001145,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":16258388,"repo":"volatilityfoundation/volatility3","listed_as":"volatilityfoundation/volatility3","name":"Volatility 3","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"Volatility 3.0 development","license":"other","stars":4515,"archived":false,"last_commit":"2026-10-12T09:18:06Z","days_since_commit":7,"release":{"tag":"v2.28.2","date":"2026-09-17T19:47:09Z","assets":2,"verification":"none"},"weeks":[0,0,1,11,2,7,0,1,0,23,5,1,0,6,0,0,3,0,2,7,2,1,1,2,0,0,1,0,0,0,4,0,4,0,0,0,0,3,0,1,1,4,3,0,1,3,1,0,1,1,1,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":16258388,"owner_id":6001145,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":30304847,"repo":"mkorman90/VolatilityBot","listed_as":"mkorman90/VolatilityBot","name":"VolatilityBot","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"VolatilityBot – An automated memory analyzer for malware samples and memory dumps ","license":"MIT","stars":269,"archived":false,"last_commit":"2021-06-15T05:31:06Z","days_since_commit":1952,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":30304847,"owner_id":5430032,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":34188051,"repo":"H2Cyber/VolDiff","listed_as":"aim4r/VolDiff","name":"VolDiff","category":"incident-response","subcategory":"Memory Analysis Tools","source":"awesome-incident-response","description":"VolDiff: Malware Memory Footprint Analysis based on Volatility","license":"BSD-2-Clause","stars":195,"archived":true,"last_commit":"2017-09-12T19:59:23Z","days_since_commit":3324,"release":{"tag":"v2.1","date":"2015-06-18T22:02:26Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"renamed","from":"aim4r/VolDiff","to":"H2Cyber/VolDiff"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":34188051,"owner_id":764189,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":101311218,"repo":"ydkhatri/mac_apt","listed_as":"ydkhatri/mac_apt","name":"macOS Artifact Parsing Tool (macapt)","category":"incident-response","subcategory":"OSX Evidence Collection","source":"awesome-incident-response","description":"macOS (& ios) Artifact Parsing Tool","license":"MIT","stars":1094,"archived":false,"last_commit":"2026-10-18T03:34:57Z","days_since_commit":1,"release":{"tag":"v.1.36.2","date":"2026-10-10T04:02:40Z","assets":8,"verification":"none"},"weeks":[0,0,2,1,0,8,6,2,1,0,0,4,0,1,3,4,0,1,0,1,0,1,0,0,0,0,0,0,0,1,0,0,0,0,4,1,0,0,10,0,0,0,4,0,0,0,0,0,2,5,0,2],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":101311218,"owner_id":13247440,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":10801048,"repo":"jipegit/OSXAuditor","listed_as":"jipegit/OSXAuditor","name":"OSX Auditor","category":"incident-response","subcategory":"OSX Evidence Collection","source":"awesome-incident-response","description":"OS X Auditor is a free Mac OS X computer forensics tool","license":"other","stars":3130,"archived":false,"last_commit":"2020-07-27T22:34:24Z","days_since_commit":2274,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":10801048,"owner_id":4620502,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":22615096,"repo":"YelpArchive/osxcollector","listed_as":"yelp/osxcollector","name":"OSX Collector","category":"incident-response","subcategory":"OSX Evidence Collection","source":"awesome-incident-response","description":"A forensic evidence collection & analysis toolkit for OS X","license":"other","stars":1889,"archived":true,"last_commit":"2019-06-19T15:40:48Z","days_since_commit":2679,"release":{"tag":"v1.10","date":"2018-06-15T22:11:39Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"renamed","from":"yelp/osxcollector","to":"YelpArchive/osxcollector"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":22615096,"owner_id":8711918,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":270993117,"repo":"cyb3rfox/Aurora-Incident-Response","listed_as":"cyb3rfox/Aurora-Incident-Response","name":"Aurora Incident Response","category":"incident-response","subcategory":"Timeline Tools","source":"awesome-incident-response","description":"Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders","license":"Apache-2.0","stars":1083,"archived":false,"last_commit":"2022-10-26T06:40:21Z","days_since_commit":1454,"release":{"tag":"0.6.6","date":"2021-03-29T13:13:51Z","assets":3,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":270993117,"owner_id":33657602,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":13639712,"repo":"etsy/morgue","listed_as":"etsy/morgue","name":"Morgue","category":"incident-response","subcategory":"Timeline Tools","source":"awesome-incident-response","description":"post mortem tracker","license":"MIT","stars":1018,"archived":true,"last_commit":"2019-05-21T14:42:24Z","days_since_commit":2708,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":13639712,"owner_id":193389,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":23812315,"repo":"log2timeline/plaso","listed_as":"log2timeline/plaso","name":"Plaso","category":"incident-response","subcategory":"Timeline Tools","source":"awesome-incident-response","description":"Super timeline all the things","license":"Apache-2.0","stars":2174,"archived":false,"last_commit":"2026-10-18T12:14:41Z","days_since_commit":1,"release":{"tag":"20260720","date":"2026-07-20T07:57:02Z","assets":2,"verification":"signature"},"weeks":[1,0,0,5,4,0,0,0,5,0,0,1,1,0,0,3,0,0,0,0,0,0,0,2,4,1,9,24,33,7,2,0,0,2,0,19,21,10,6,3,3,0,0,7,0,0,4,0,34,15,15,2],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":23812315,"owner_id":8701971,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":21009909,"repo":"google/timesketch","listed_as":"google/timesketch","name":"Timesketch","category":"incident-response","subcategory":"Timeline Tools","source":"awesome-incident-response","description":"Collaborative forensic timeline analysis","license":"Apache-2.0","stars":3435,"archived":false,"last_commit":"2026-10-14T15:24:39Z","days_since_commit":5,"release":{"tag":"20261014","date":"2026-10-14T15:06:04Z","assets":0,"verification":null},"weeks":[3,17,17,16,2,5,8,16,4,0,19,6,9,1,9,31,11,3,25,13,1,16,1,0,0,0,0,2,2,2,2,0,36,18,9,9,2,0,5,2,1,0,1,2,4,1,0,2,0,4,24,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":21009909,"owner_id":1342004,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":36251235,"repo":"OMENScan/AChoir","listed_as":"OMENScan/AChoir","name":"AChoir","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"Windows Live Artifacts Acquisition Script","license":"GPL-2.0","stars":195,"archived":false,"last_commit":"2022-06-20T15:05:54Z","days_since_commit":1582,"release":{"tag":"4.4a","date":"2020-08-08T04:54:52Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":36251235,"owner_id":6663192,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":44803137,"repo":"SekoiaLab/Fastir_Collector","listed_as":"SekoiaLab/Fastir_Collector","name":"FastIR Collector","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"","license":"GPL-3.0","stars":516,"archived":false,"last_commit":"2021-01-26T08:20:09Z","days_since_commit":2092,"release":{"tag":"V1.1","date":"2017-05-16T08:44:06Z","assets":4,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":44803137,"owner_id":6544502,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":54714794,"repo":"rabbitstack/fibratus","listed_as":"rabbitstack/fibratus","name":"Fibratus","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"Security sensor for realtime threat detection and protection","license":"other","stars":2557,"archived":false,"last_commit":"2026-10-18T16:11:11Z","days_since_commit":1,"release":{"tag":"v3.1.1","date":"2026-08-19T16:53:23Z","assets":4,"verification":"checksum"},"weeks":[0,0,0,0,0,0,0,4,8,12,5,4,1,17,20,15,15,8,8,0,3,2,0,0,4,4,2,6,7,2,1,1,15,5,7,9,4,7,6,13,15,0,2,0,1,3,3,0,3,0,0,0],"advisories":[],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":54714794,"owner_id":11174375,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":162840501,"repo":"muteb/Hoarder","listed_as":"muteb/Hoarder","name":"Hoarder","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive. ","license":"GPL-3.0","stars":217,"archived":false,"last_commit":"2020-10-19T09:42:13Z","days_since_commit":2191,"release":{"tag":"4.0.0","date":"2020-08-05T09:55:09Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":162840501,"owner_id":5000589,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":117418384,"repo":"mgreen27/Invoke-LiveResponse","listed_as":"mgreen27/Invoke-LiveResponse","name":"Invoke-LiveResponse","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"Invoke-LiveResponse","license":"MIT","stars":151,"archived":false,"last_commit":"2022-02-22T05:07:34Z","days_since_commit":1700,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":117418384,"owner_id":13081800,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":41906325,"repo":"AJMartel/IRTriage","listed_as":"AJMartel/IRTriage","name":"IRTriage","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":" Incident Response Triage - Windows Evidence Collection for Forensic Analysis","license":"","stars":139,"archived":false,"last_commit":"2016-04-21T09:11:59Z","days_since_commit":3833,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":41906325,"owner_id":9853311,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":120753048,"repo":"TonyPhipps/Meerkat","listed_as":"TonyPhipps/Meerkat","name":"MEERKAT","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.","license":"GPL-3.0","stars":483,"archived":false,"last_commit":"2024-11-15T17:06:34Z","days_since_commit":703,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":120753048,"owner_id":17801619,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":68045524,"repo":"AlmCo/Panorama","listed_as":"AlmCo/Panorama","name":"Panorama","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"Fast incident overview","license":"","stars":41,"archived":false,"last_commit":"2017-02-11T11:12:31Z","days_since_commit":3537,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":68045524,"owner_id":15038417,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":31820011,"repo":"Invoke-IR/PowerForensics","listed_as":"Invoke-IR/PowerForensics","name":"PowerForensics","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"PowerForensics provides an all in one platform for live disk forensic analysis","license":"MIT","stars":1444,"archived":false,"last_commit":"2018-04-20T10:34:59Z","days_since_commit":3104,"release":{"tag":"1.1.1","date":"2016-01-30T00:36:40Z","assets":2,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":31820011,"owner_id":5545481,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":40107037,"repo":"gfoss/PSRecon","listed_as":"gfoss/PSRecon","name":"PSRecon","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":":rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.","license":"Apache-2.0","stars":494,"archived":false,"last_commit":"2017-07-29T15:03:03Z","days_since_commit":3369,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":40107037,"owner_id":727732,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":267355742,"repo":"keydet89/RegRipper3.0","listed_as":"keydet89/RegRipper3.0","name":"RegRipper","category":"incident-response","subcategory":"Windows Evidence Collection","source":"awesome-incident-response","description":"RegRipper3.0","license":"other","stars":724,"archived":false,"last_commit":"2026-05-27T13:22:58Z","days_since_commit":145,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,4,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":267355742,"owner_id":8234207,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":1161193354,"repo":"FlipForensics/AIFT","listed_as":"FlipForensics/AIFT","name":"AIFT","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"AIFT is a GUI, CLI, REST API, and MCP tool that helps DFIR analysts get oriented quickly. Point it at disk images, VM images, forensic archives, or triage packages; AIFT discovers what can be opened, parses artifacts with Dissect, and uses AI to turn parsed data into concrete leads and gaps for the investigator to verify. ","license":"AGPL-3.0","stars":51,"archived":false,"last_commit":"2026-06-13T14:24:58Z","days_since_commit":128,"release":{"tag":"v2.0","date":"2026-06-13T14:41:18Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,40,0,0,110,3,31,44,24,1,0,0,0,9,53,69,110,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":1161193354,"owner_id":225379561,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":149800498,"repo":"coinbase/dexter","listed_as":"coinbase/dexter","name":"dexter","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"Forensics acquisition framework designed to be extensible and secure","license":"Apache-2.0","stars":126,"archived":false,"last_commit":"2019-06-21T21:02:39Z","days_since_commit":2677,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":149800498,"owner_id":1885080,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":42932665,"repo":"arxsys/dff","listed_as":"arxsys/dff","name":"dff","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"DFF (Digital Forensics Framework) is a Forensics Framework coming with command line and graphical interfaces. DFF can be used to investigate hard drives and volatile memory and create reports about user and system activities.","license":"GPL-2.0","stars":317,"archived":false,"last_commit":"2016-05-19T08:10:50Z","days_since_commit":3805,"release":{"tag":"1.4.0","date":"2020-02-13T14:34:38Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":42932665,"owner_id":818247,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":413041560,"repo":"hashlookup/hashlookup-forensic-analyser","listed_as":"hashlookup/hashlookup-forensic-analyser","name":"hashlookup-forensic-analyser","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/","license":"other","stars":131,"archived":false,"last_commit":"2023-09-24T12:43:41Z","days_since_commit":1121,"release":{"tag":"v1.3","date":"2023-09-24T12:52:25Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":413041560,"owner_id":91272032,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":21160389,"repo":"certtools/intelmq","listed_as":"certtools/intelmq","name":"IntelMQ","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.","license":"AGPL-3.0","stars":1142,"archived":false,"last_commit":"2026-04-24T16:04:45Z","days_since_commit":178,"release":{"tag":"3.5.0","date":"2025-11-01T08:11:09Z","assets":0,"verification":null},"weeks":[15,2,0,1,0,2,0,0,4,0,0,0,0,0,0,2,0,0,1,0,0,0,0,0,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":21160389,"owner_id":5830035,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":37327577,"repo":"lmco/laikaboss","listed_as":"lmco/laikaboss","name":"Laika BOSS","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"Laika BOSS: Object Scanning System","license":"Apache-2.0","stars":754,"archived":false,"last_commit":"2018-09-11T15:23:25Z","days_since_commit":2960,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":37327577,"owner_id":306339,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":2562873,"repo":"sleuthkit/sleuthkit","listed_as":"sleuthkit/sleuthkit","name":"The Sleuth Kit","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence. ","license":"","stars":3166,"archived":false,"last_commit":"2026-10-14T20:15:07Z","days_since_commit":5,"release":{"tag":"sleuthkit-4.15.0","date":"2026-04-15T18:09:44Z","assets":4,"verification":"signature"},"weeks":[19,0,0,0,2,0,2,4,0,0,3,0,0,0,0,0,1,9,32,17,15,9,43,12,20,6,22,4,0,0,13,10,6,4,1,2,0,7,0,0,0,3,42,2,1,0,7,12,12,9,12,0],"advisories":[],"status":"active","signals":[{"type":"no_license"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":2562873,"owner_id":866922,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":42533053,"repo":"google/turbinia","listed_as":"google/turbinia","name":"turbinia","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"Automation and Scaling of Digital Forensics Tools","license":"Apache-2.0","stars":795,"archived":false,"last_commit":"2026-10-17T07:39:00Z","days_since_commit":2,"release":{"tag":"20250131","date":"2025-02-05T23:01:15Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,2,1,0,0,0,0,1,0,0,3,2,0,0,0,3,0,0,0,0,0,0,0,0,0,1,0,1,4,1,0,1,0,0,0,0,0,0,1,0,0,1,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":42533053,"owner_id":1342004,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":37318294,"repo":"sepinf-inc/IPED","listed_as":"sepinf-inc/IPED","name":"IPED - Indexador e Processador de Evidências Digitais","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.","license":"other","stars":3055,"archived":false,"last_commit":"2026-10-15T20:22:37Z","days_since_commit":4,"release":{"tag":"4.3.1","date":"2026-03-29T01:03:02Z","assets":2,"verification":"none"},"weeks":[19,29,25,19,11,5,15,3,0,20,4,4,1,1,4,9,0,16,6,3,7,21,23,6,1,6,0,0,0,5,5,5,13,2,4,1,2,4,1,2,2,5,3,10,18,5,20,8,33,6,1,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":37318294,"owner_id":66639503,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":32156692,"repo":"pjrinaldi/wombatforensics","listed_as":"pjrinaldi/wombatforensics","name":"Wombat Forensics","category":"digital-forensics","subcategory":"Frameworks","source":"awesome-forensics","description":"linux c++, fox-toolkit, multi-threaded forensic gui tool","license":"GPL-2.0","stars":48,"archived":false,"last_commit":"2024-07-19T22:25:06Z","days_since_commit":821,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":32156692,"owner_id":5614455,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":112082201,"repo":"intezer/linux-explorer","listed_as":"intezer/linux-explorer","name":"Linux Expl0rer","category":"digital-forensics","subcategory":"Live Forensics","source":"awesome-forensics","description":"Easy-to-use live forensics toolbox for Linux endpoints","license":"Apache-2.0","stars":404,"archived":true,"last_commit":"2024-03-03T19:35:59Z","days_since_commit":960,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":112082201,"owner_id":13666399,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":12719968,"repo":"mozilla/mig","listed_as":"mozilla/mig","name":"mig","category":"digital-forensics","subcategory":"Live Forensics","source":"awesome-forensics","description":"Distributed & real time digital forensics at the speed of the cloud","license":"MPL-2.0","stars":1203,"archived":true,"last_commit":"2019-09-13T23:40:10Z","days_since_commit":2592,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":12719968,"owner_id":131524,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":22394357,"repo":"osquery/osquery","listed_as":"osquery/osquery","name":"osquery","category":"digital-forensics","subcategory":"Live Forensics","source":"awesome-forensics","description":"SQL powered operating system instrumentation, monitoring, and analytics.","license":"other","stars":23655,"archived":false,"last_commit":"2026-10-15T16:57:10Z","days_since_commit":4,"release":{"tag":"5.23.1","date":"2026-06-24T14:57:05Z","assets":17,"verification":"none"},"weeks":[0,1,0,0,0,2,5,4,0,0,2,1,0,0,2,1,6,5,1,7,0,1,1,5,3,13,5,3,1,0,0,0,1,2,5,1,4,7,1,5,3,5,1,1,0,1,14,6,5,21,11,0],"advisories":[{"id":"GHSA-4r78-6hg6-33gg","cve":"CVE-2026-54000","severity":"high","published":"2026-07-01","summary":"Heap buffer overflow via `processes` table (Windows)"},{"id":"GHSA-hr28-jvpx-68cx","cve":"CVE-2026-54001","severity":"high","published":"2026-07-01","summary":"Heap buffer overflow via `authenticode` table (Windows)"},{"id":"GHSA-fg78-9q98-62hh","cve":"CVE-2026-46388","severity":"medium","published":"2026-07-01","summary":"Unprivileged users can temporarily read file carve contents"},{"id":"GHSA-4g56-2482-x7q8","cve":"CVE-2020-26273","severity":"medium","published":"2020-12-15","summary":"sqlite ATTACH allows some filesystem access"},{"id":"GHSA-29q7-6g57-5vc6","cve":"CVE-2017-15028","severity":"low","published":"2020-07-10","summary":"known_hosts should drop privileges"},{"id":"GHSA-hx5j-mvj5-rq2m","cve":"CVE-2017-15027","severity":"low","published":"2020-07-10","summary":"safari_extensions table should not use parent paths for privilege dropping"},{"id":"GHSA-3227-mxf9-vw74","cve":"CVE-2017-15026","severity":"low","published":"2020-07-10","summary":"ie_extensions table susceptible to SQL injection"},{"id":"GHSA-pjmv-4494-jx3f","cve":"CVE-2020-1887","severity":"low","published":"2020-07-10","summary":"osquery does not validate TLS SNI hostname"},{"id":"GHSA-2xwp-8fv7-c5pm","cve":"CVE-2020-11081","severity":"low","published":"2020-07-10","summary":"osquery susceptible to DLL search order hijacking of zlib1.dll"}],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":22394357,"owner_id":8315868,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":342284641,"repo":"gmagklaras/POFR","listed_as":"gmagklaras/pofr","name":"POFR","category":"digital-forensics","subcategory":"Live Forensics","source":"awesome-forensics","description":"Penguin OS Forensic (or Flight) Recorder","license":"GPL-2.0","stars":41,"archived":false,"last_commit":"2026-03-27T20:03:16Z","days_since_commit":206,"release":{"tag":"v1.4.0","date":"2026-03-27T20:10:30Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":342284641,"owner_id":9783801,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":1061813210,"repo":"prosch88/ALEX","listed_as":"prosch88/ALEX","name":"ALEX","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"Extract files from ADB devices on Windows, Linux and MacOS. Mostly a wrapper for adbutils. ","license":"GPL-3.0","stars":116,"archived":false,"last_commit":"2026-10-16T16:40:16Z","days_since_commit":3,"release":{"tag":"v0.7","date":"2026-10-16T19:24:56Z","assets":3,"verification":"none"},"weeks":[13,5,3,1,5,4,13,14,9,0,8,31,4,11,5,3,0,4,22,2,0,1,0,3,0,0,23,5,0,0,0,0,3,0,9,6,0,0,5,6,2,0,0,0,2,2,0,9,7,6,8,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1061813210,"owner_id":48532778,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":1182528205,"repo":"noirlang/amele","listed_as":"noirlang/amele","name":"Amele","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"Unified digital forensics platform bringing disk, RAM, container drift, logical acquisition, and backup analysis together for Windows, Linux, Docker, Android, and iOS.","license":"other","stars":28,"archived":false,"last_commit":"2026-10-10T09:43:44Z","days_since_commit":9,"release":{"tag":"v0.1.1","date":"2026-10-08T13:24:02Z","assets":8,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,56,23,55,4,3,20,55,31,16,3,27,1,48,33,23,6,49,9,43,73,44,0,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1182528205,"owner_id":209094171,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":590513065,"repo":"fit-project/fit","listed_as":"fit-project/fit","name":"FIT","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"FIT is a modular suite of Python applications for digital forensic acquisition of online contents such as web pages, emails, social media, and more. Each module can run independently or as part of the full FIT suite.","license":"GPL-3.0","stars":106,"archived":false,"last_commit":"2025-10-27T14:10:58Z","days_since_commit":357,"release":{"tag":"v2.2.0","date":"2025-03-16T15:58:27Z","assets":2,"verification":"none"},"weeks":[1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":590513065,"owner_id":119516128,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":720716930,"repo":"securityjoes/ForensicMiner","listed_as":"securityjoes/ForensicMiner","name":"ForensicMiner","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.","license":"MIT","stars":164,"archived":false,"last_commit":"2025-04-06T11:47:05Z","days_since_commit":561,"release":{"tag":"v1.4","date":"2023-12-30T00:26:14Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":720716930,"owner_id":51166653,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":786147112,"repo":"Lazza/Fuji","listed_as":"Lazza/Fuji","name":"Fuji","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"macOS forensic acquisition made simple","license":"GPL-3.0","stars":311,"archived":false,"last_commit":"2026-06-02T13:45:20Z","days_since_commit":139,"release":{"tag":"1.2.0","date":"2026-02-14T23:28:11Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,3,10,33,3,0,2,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":786147112,"owner_id":8294041,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":868251410,"repo":"xinitd/hypoxia","listed_as":"xinitd/hypoxia","name":"Hypoxia","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"Zero-dependency Python CLI for targeted file collection - digital forensics, incident response, and selective backups. Cross-platform, with SHA-256 manifests, chain-of-custody logging, and checkpoint/resume for failing media.","license":"GPL-3.0","stars":4,"archived":false,"last_commit":"2026-04-09T17:59:59Z","days_since_commit":193,"release":{"tag":"1.3.0","date":"2026-04-09T18:05:36Z","assets":2,"verification":"checksum"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,9,9,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":868251410,"owner_id":153020509,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":24379459,"repo":"jtsylve/LiME","listed_as":"jtsylve/LiME","name":"LiME","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory capt","license":"GPL-2.0","stars":2051,"archived":false,"last_commit":"2026-04-05T13:42:43Z","days_since_commit":197,"release":{"tag":"v1.12.0","date":"2026-03-31T14:21:08Z","assets":0,"verification":null},"weeks":[0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,1,16,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":24379459,"owner_id":594165,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":774774708,"repo":"prosch88/UFADE","listed_as":"prosch88/UFADE","name":"UFADE","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"Extract files from Apple devices on Windows, Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and \"advanced logical backups\" ","license":"GPL-3.0","stars":585,"archived":false,"last_commit":"2026-10-19T21:49:47Z","days_since_commit":0,"release":{"tag":"v1.0.5","date":"2026-10-16T19:07:22Z","assets":3,"verification":"none"},"weeks":[0,5,3,0,1,0,0,0,0,0,9,1,29,0,1,3,0,0,4,0,4,1,0,0,0,11,0,0,0,0,0,0,1,0,1,3,0,0,0,6,0,0,1,0,0,3,0,1,1,0,8,2],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":774774708,"owner_id":48532778,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":468045607,"repo":"op7ic/unix_collector","listed_as":"op7ic/unix_collector","name":"unixcollector","category":"digital-forensics","subcategory":"Acquisition","source":"awesome-forensics","description":"unix_collector is a Live Response collection script for Incident Response on UNIX-like systems using native binaries. Supports AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.","license":"GPL-3.0","stars":44,"archived":false,"last_commit":"2026-06-18T20:04:24Z","days_since_commit":123,"release":{"tag":"2.0","date":"2025-06-10T15:05:34Z","assets":3,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":468045607,"owner_id":3172590,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":45019001,"repo":"denandz/KeeFarce","listed_as":"denandz/KeeFarce","name":"KeeFarce","category":"digital-forensics","subcategory":"Memory Forensics","source":"awesome-forensics","description":"Extracts passwords from a KeePass 2.x database, directly from memory.","license":"BSD-3-Clause","stars":1031,"archived":false,"last_commit":"2015-11-17T04:12:25Z","days_since_commit":3989,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":45019001,"owner_id":5291556,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":158113416,"repo":"ufrisk/MemProcFS","listed_as":"ufrisk/MemProcFS","name":"MemProcFS","category":"digital-forensics","subcategory":"Memory Forensics","source":"awesome-forensics","description":"MemProcFS","license":"AGPL-3.0","stars":4381,"archived":false,"last_commit":"2026-10-05T18:10:04Z","days_since_commit":14,"release":{"tag":"v5.19","date":"2026-10-05T17:38:01Z","assets":6,"verification":"none"},"weeks":[0,1,1,0,0,3,0,0,0,0,1,1,2,1,1,0,0,3,1,0,0,1,0,0,1,1,0,0,1,0,0,2,0,0,0,0,1,0,1,1,2,1,1,1,1,4,1,0,0,2,0,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":158113416,"owner_id":18221464,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":19864741,"repo":"google/rekall","listed_as":"google/rekall","name":"Rekall","category":"digital-forensics","subcategory":"Memory Forensics","source":"awesome-forensics","description":"Rekall Memory Forensic Framework","license":"GPL-2.0","stars":2006,"archived":true,"last_commit":"2020-10-17T22:34:30Z","days_since_commit":2192,"release":{"tag":"v1.7.1","date":"2017-11-06T05:37:33Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":19864741,"owner_id":1342004,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":54400669,"repo":"kevthehermit/VolUtility","listed_as":"kevthehermit/VolUtility","name":"VolUtility","category":"digital-forensics","subcategory":"Memory Forensics","source":"awesome-forensics","description":"Web App for Volatility framework","license":"GPL-3.0","stars":389,"archived":false,"last_commit":"2017-01-20T09:34:55Z","days_since_commit":3559,"release":{"tag":"v1.2","date":"2017-01-03T14:54:01Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":54400669,"owner_id":2545096,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":118381427,"repo":"yampelo/beagle","listed_as":"yampelo/beagle","name":"Beagle","category":"digital-forensics","subcategory":"Windows Artifacts","source":"awesome-forensics","description":"Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.","license":"MIT","stars":1358,"archived":false,"last_commit":"2019-12-03T04:30:00Z","days_since_commit":2512,"release":{"tag":"v1.0.5","date":"2019-05-28T23:35:38Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":118381427,"owner_id":6065272,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":704668508,"repo":"cgosec/Blauhaunt","listed_as":"cgosec/Blauhaunt","name":"Blauhaunt","category":"digital-forensics","subcategory":"Windows Artifacts","source":"awesome-forensics","description":"A tool collection for filtering and visualizing logon events. Designed to help answering the \"Cotton Eye Joe\" question (Where did you come from where did you go) in Security Incidents and Threat Hunts","license":"MIT","stars":186,"archived":false,"last_commit":"2026-08-18T20:06:34Z","days_since_commit":62,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,1,0,0,0,0,0,0,0,0,0,0,0,0,2,6,0,0,7,11,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":704668508,"owner_id":147876916,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":29782167,"repo":"williballenthin/python-evt","listed_as":"williballenthin/python-evt","name":"python-evt","category":"digital-forensics","subcategory":"Windows Artifacts","source":"awesome-forensics","description":"Pure Python parser for classic Windows Event Log files (.evt)","license":"Apache-2.0","stars":52,"archived":false,"last_commit":"2023-06-30T19:55:19Z","days_since_commit":1207,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":29782167,"owner_id":156560,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":180773594,"repo":"airbus-cert/regrippy","listed_as":"airbus-cert/regrippy","name":"RegRippy","category":"digital-forensics","subcategory":"Windows Artifacts","source":"awesome-forensics","description":"A modern Python-3-based alternative to RegRipper","license":"Apache-2.0","stars":220,"archived":false,"last_commit":"2026-05-12T15:04:55Z","days_since_commit":160,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":180773594,"owner_id":26453405,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":14870571,"repo":"aarsakian/FileSystemForensics","listed_as":"aarsakian/FileSystemForensics","name":"MFTExtractor","category":"digital-forensics","subcategory":"NTFS/MFT Processing","source":"awesome-forensics","description":"File system forensics","license":"other","stars":18,"archived":false,"last_commit":"2026-09-13T09:35:44Z","days_since_commit":36,"release":{"tag":"0.5.6","date":"2026-07-16T20:22:21Z","assets":1,"verification":"none"},"weeks":[3,3,12,9,0,3,0,0,0,0,12,17,0,0,0,0,0,7,7,0,8,0,0,0,0,0,9,8,11,0,14,0,10,10,37,13,38,54,4,9,0,0,0,0,7,1,1,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":14870571,"owner_id":304561,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":243850864,"repo":"thewhiteninja/ntfstool","listed_as":"thewhiteninja/ntfstool","name":"NTFSTool","category":"digital-forensics","subcategory":"NTFS/MFT Processing","source":"awesome-forensics","description":"Forensics tool for NTFS (parser, mft, bitlocker, deleted files) ","license":"MIT","stars":630,"archived":false,"last_commit":"2026-06-26T21:09:20Z","days_since_commit":115,"release":{"tag":"v1.7","date":"2023-07-23T09:49:02Z","assets":4,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":243850864,"owner_id":40250307,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":45421076,"repo":"PoorBillionaire/USN-Journal-Parser","listed_as":"PoorBillionaire/USN-Journal-Parser","name":"NTFS USN Journal parser","category":"digital-forensics","subcategory":"NTFS/MFT Processing","source":"awesome-forensics","description":"Python script to parse the NTFS USN Journal","license":"other","stars":119,"archived":false,"last_commit":"2021-04-26T22:30:44Z","days_since_commit":2001,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":45421076,"owner_id":7146190,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":50295498,"repo":"Lazza/RecuperaBit","listed_as":"Lazza/RecuperaBit","name":"RecuperaBit","category":"digital-forensics","subcategory":"NTFS/MFT Processing","source":"awesome-forensics","description":"A tool for forensic file system reconstruction.","license":"GPL-3.0","stars":625,"archived":false,"last_commit":"2026-07-26T20:05:07Z","days_since_commit":85,"release":{"tag":"v1.1.6","date":"2022-01-02T16:17:18Z","assets":0,"verification":null},"weeks":[0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":50295498,"owner_id":8294041,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":23522701,"repo":"williballenthin/python-ntfs","listed_as":"williballenthin/python-ntfs","name":"python-ntfs","category":"digital-forensics","subcategory":"NTFS/MFT Processing","source":"awesome-forensics","description":"Open source Python library for NTFS analysis","license":"Apache-2.0","stars":86,"archived":false,"last_commit":"2017-09-04T16:07:24Z","days_since_commit":3332,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":23522701,"owner_id":156560,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":106879638,"repo":"sgan81/apfs-fuse","listed_as":"sgan81/apfs-fuse","name":"APFS Fuse","category":"digital-forensics","subcategory":"OS X Forensics","source":"awesome-forensics","description":"FUSE driver for APFS (Apple File System)","license":"GPL-2.0","stars":2161,"archived":false,"last_commit":"2023-03-12T18:21:57Z","days_since_commit":1317,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":106879638,"owner_id":32782680,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":60570888,"repo":"mac4n6/Mac-Locations-Scraper","listed_as":"mac4n6/Mac-Locations-Scraper","name":"MacLocationsScraper","category":"digital-forensics","subcategory":"OS X Forensics","source":"awesome-forensics","description":"macOS/iOS database location scraper to extract location data","license":"","stars":92,"archived":false,"last_commit":"2018-09-07T22:05:48Z","days_since_commit":2964,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":60570888,"owner_id":15172956,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":63007765,"repo":"mac4n6/macMRU-Parser","listed_as":"mac4n6/macMRU-Parser","name":"macMRUParser","category":"digital-forensics","subcategory":"OS X Forensics","source":"awesome-forensics","description":"Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format.","license":"","stars":111,"archived":false,"last_commit":"2017-12-11T03:13:03Z","days_since_commit":3234,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":63007765,"owner_id":15172956,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":22615096,"repo":"YelpArchive/osxcollector","listed_as":"YelpArchive/osxcollector","name":"OSX Collect","category":"digital-forensics","subcategory":"OS X Forensics","source":"awesome-forensics","description":"A forensic evidence collection & analysis toolkit for OS X","license":"other","stars":1889,"archived":true,"last_commit":"2019-06-19T15:40:48Z","days_since_commit":2679,"release":{"tag":"v1.10","date":"2018-06-15T22:11:39Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":22615096,"owner_id":8711918,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":227929809,"repo":"den4uk/andriller","listed_as":"den4uk/andriller","name":"Andriller","category":"digital-forensics","subcategory":"Mobile Forensics","source":"awesome-forensics","description":"📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.","license":"MIT","stars":1619,"archived":false,"last_commit":"2022-06-27T22:00:44Z","days_since_commit":1575,"release":{"tag":"3.6.3","date":"2022-04-30T14:57:06Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":227929809,"owner_id":4115599,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":242402791,"repo":"abrignoni/ALEAPP","listed_as":"abrignoni/ALEAPP","name":"ALEAPP","category":"digital-forensics","subcategory":"Mobile Forensics","source":"awesome-forensics","description":"Android Logs Events And Protobuf Parser","license":"MIT","stars":1013,"archived":false,"last_commit":"2026-10-19T21:41:17Z","days_since_commit":0,"release":{"tag":"v2026.4.3","date":"2026-10-02T00:35:36Z","assets":9,"verification":"checksum"},"weeks":[1,2,5,28,7,3,9,10,0,0,8,10,0,4,3,3,1,6,13,4,6,8,4,0,0,2,0,0,6,13,26,7,8,172,194,26,28,16,58,42,97,77,113,84,206,111,21,39,76,366,56,4],"advisories":[{"id":"GHSA-9xqw-4qrc-5qp5","cve":"","severity":"medium","published":"2026-07-25","summary":"Stored HTML/JavaScript injection in HTML report cells: evidence-derived values listed in an artifact's `html_columns` are written to the HTML report without escaping, so malicious content in a parsed extraction/return can execute JavaScript in the examiner's browser when the report is opened."}],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":242402791,"owner_id":28718987,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":229842283,"repo":"abrignoni/iLEAPP","listed_as":"abrignoni/iLEAPP","name":"iLEAPP","category":"digital-forensics","subcategory":"Mobile Forensics","source":"awesome-forensics","description":"iOS Logs, Events, And Plist Parser","license":"MIT","stars":1394,"archived":false,"last_commit":"2026-10-19T20:57:58Z","days_since_commit":0,"release":{"tag":"v2026.4.4","date":"2026-10-02T00:35:33Z","assets":9,"verification":"checksum"},"weeks":[10,22,22,21,11,17,8,9,2,1,7,3,1,2,5,1,0,2,6,12,43,10,18,0,1,5,5,2,10,11,27,37,20,53,143,35,63,43,59,132,91,84,102,75,83,118,89,89,69,262,89,20],"advisories":[{"id":"GHSA-45q2-q93c-cfv2","cve":"","severity":"medium","published":"2026-07-21","summary":"Stored HTML/JavaScript injection in HTML report cells: evidence-derived values listed in an artifact's `html_columns` are written to the HTML report without escaping, so malicious content in a parsed extraction/return can execute JavaScript in the examiner's browser when the report is opened."}],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":229842283,"owner_id":28718987,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":48345638,"repo":"mac4n6/iOS-Frequent-Locations-Dumper","listed_as":"mac4n6/iOS-Frequent-Locations-Dumper","name":"iOS Frequent Locations Dumper","category":"digital-forensics","subcategory":"Mobile Forensics","source":"awesome-forensics","description":"Dump the iOS Frequent Location binary plist files","license":"","stars":92,"archived":false,"last_commit":"2018-11-04T16:34:32Z","days_since_commit":2906,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":48345638,"owner_id":15172956,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":255400766,"repo":"jfarley248/MEAT","listed_as":"jfarley248/MEAT","name":"MEAT","category":"digital-forensics","subcategory":"Mobile Forensics","source":"awesome-forensics","description":"This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices","license":"GPL-3.0","stars":168,"archived":false,"last_commit":"2020-05-21T01:53:02Z","days_since_commit":2342,"release":{"tag":"v1.0.3","date":"2020-04-22T19:19:36Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":255400766,"owner_id":32943754,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":120346905,"repo":"vgmoose/OpenBackupExtractor","listed_as":"vgmoose/OpenBackupExtractor","name":"OpenBackupExtractor","category":"digital-forensics","subcategory":"Mobile Forensics","source":"awesome-forensics","description":" A free program for extracting data (like voicemails) from iPhone and iPad backups.","license":"GPL-3.0","stars":192,"archived":false,"last_commit":"2022-01-06T09:02:07Z","days_since_commit":1747,"release":{"tag":"1.1","date":"2018-03-21T20:19:27Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":120346905,"owner_id":2467473,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":20046426,"repo":"RyanDFIR/hindsight","listed_as":"RyanDFIR/hindsight","name":"hindsight","category":"digital-forensics","subcategory":"Internet Artifacts","source":"awesome-forensics","description":"Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox","license":"Apache-2.0","stars":1542,"archived":false,"last_commit":"2026-10-18T23:58:55Z","days_since_commit":0,"release":{"tag":"v2026.06","date":"2026-07-08T23:33:43Z","assets":8,"verification":"none"},"weeks":[0,0,0,0,0,2,4,0,0,1,3,4,0,5,3,0,4,5,1,0,0,1,0,1,5,0,4,8,5,9,9,4,6,6,4,0,10,3,0,0,1,1,3,0,25,10,12,3,1,0,2,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":20046426,"owner_id":4984680,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":234748117,"repo":"moaistory/IE10Analyzer","listed_as":"moaistory/IE10Analyzer","name":"IE10Analyzer","category":"digital-forensics","subcategory":"Internet Artifacts","source":"awesome-forensics","description":"http://moaistory.blogspot.com/2016/08/ie10analyzer.html","license":"MIT","stars":20,"archived":false,"last_commit":"2021-03-09T07:43:01Z","days_since_commit":2050,"release":{"tag":"1.0.0.6","date":"2024-07-20T11:38:46Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":234748117,"owner_id":46559733,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":219613650,"repo":"RyanDFIR/unfurl","listed_as":"RyanDFIR/unfurl","name":"unfurl","category":"digital-forensics","subcategory":"Internet Artifacts","source":"awesome-forensics","description":"Extract and Visualize Data from URLs using Unfurl","license":"Apache-2.0","stars":776,"archived":false,"last_commit":"2026-10-15T14:36:57Z","days_since_commit":4,"release":{"tag":"v2026.10","date":"2026-10-07T14:39:54Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,13,5,11,0,0,0,1,0,0,0,0,6,0,0,0,0,0,1,0,6,10,0,1,6,4,0,0,2,3,0],"advisories":[{"id":"GHSA-h5qv-qjv4-pc5m","cve":"","severity":"medium","published":"2026-01-28","summary":"Unbounded zlib decompression allows decompression bomb DoS"},{"id":"GHSA-vg9h-jx4v-cwx2","cve":"","severity":"critical","published":"2026-01-28","summary":"Debug mode always enabled by default due to string config parsing (Werkzeug debugger exposure)"}],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":219613650,"owner_id":4984680,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":233349754,"repo":"moaistory/WinSearchDBAnalyzer","listed_as":"moaistory/WinSearchDBAnalyzer","name":"WinSearchDBAnalyzer","category":"digital-forensics","subcategory":"Internet Artifacts","source":"awesome-forensics","description":"http://moaistory.blogspot.com/2018/10/winsearchdbanalyzer.html","license":"MIT","stars":134,"archived":false,"last_commit":"2021-03-09T07:39:32Z","days_since_commit":2050,"release":{"tag":"1.0.0.6","date":"2024-07-20T11:40:34Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":233349754,"owner_id":46559733,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":182230421,"repo":"airbus-cert/timeliner","listed_as":"airbus-cert/timeliner","name":"timeliner","category":"digital-forensics","subcategory":"Timeline Analysis","source":"awesome-forensics","description":"A rewrite of mactime, a bodyfile reader","license":"Apache-2.0","stars":41,"archived":false,"last_commit":"2024-08-05T09:52:46Z","days_since_commit":805,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":182230421,"owner_id":26453405,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":1154854390,"repo":"timescale/rsigma","listed_as":"timescale/rsigma","name":"RSigma | Timescale","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:","license":"MIT","stars":169,"archived":false,"last_commit":"2026-10-19T09:57:42Z","days_since_commit":0,"release":{"tag":"v0.25.0","date":"2026-10-19T08:59:14Z","assets":7,"verification":"checksum"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,68,42,12,0,1,2,5,13,0,17,30,88,66,48,101,42,73,90,80,110,93,92,33,135,155,102,0,0,0,51,33,3,21,163,14,58,102],"advisories":[{"id":"GHSA-vwg6-4q3h-8pvq","cve":"","severity":"high","published":"2026-10-19","summary":"OTLP HTTP endpoint inflates gzip bodies without a size limit"},{"id":"GHSA-3fh4-8r8j-8xw3","cve":"","severity":"medium","published":"2026-10-19","summary":"Event fields are interpolated unescaped into enricher and webhook URLs and enricher bodies"},{"id":"GHSA-33jj-q567-34gj","cve":"","severity":"medium","published":"2026-10-19","summary":"MCP tools read arbitrary files when --rules-dir is unset"},{"id":"GHSA-4q23-jm32-fhr9","cve":"","severity":"high","published":"2026-09-30","summary":"rsigma-mcp `evaluate_events` enrichers let any MCP tool caller execute commands and send arbitrary HTTP requests"},{"id":"GHSA-8x2w-m5v2-phxr","cve":"","severity":"high","published":"2026-09-30","summary":"`--rules-dir` confinement bypass lets any MCP tool caller read and mutate arbitrary files on disk"}],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1154854390,"owner_id":8986001,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":162346001,"repo":"splunk/security_content","listed_as":"splunk/security_content","name":"Splunk Security Content","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"Splunk Security Content","license":"Apache-2.0","stars":1715,"archived":false,"last_commit":"2026-10-19T18:14:44Z","days_since_commit":0,"release":{"tag":"v6.8.0","date":"2026-10-07T15:46:07Z","assets":1,"verification":"none"},"weeks":[9,8,10,17,11,13,22,20,9,0,22,18,23,18,14,11,18,19,17,24,21,26,20,9,22,7,15,12,11,33,9,0,11,35,5,10,15,13,15,14,14,7,16,14,16,12,3,22,22,31,23,16],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":162346001,"owner_id":651467,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":1176619039,"repo":"Agent-Threat-Rule/agent-threat-rules","listed_as":"Agent-Threat-Rule/agent-threat-rules","name":"Agent Threat Rules (ATR)","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.","license":"MIT","stars":418,"archived":false,"last_commit":"2026-10-19T22:00:39Z","days_since_commit":0,"release":{"tag":"pyatr-v0.3.1","date":"2026-10-15T20:55:09Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,38,29,27,8,116,99,71,14,37,49,20,88,53,39,65,12,20,70,50,16,14,59,21,27,33,22,12,16,60,20,56,84,33],"advisories":[{"id":"GHSA-66x9-5vw9-3wv3","cve":"","severity":"high","published":"2026-10-15","summary":"ReDoS (catastrophic backtracking) in rule ATR-2026-00220 — availability DoS on alert/hunt-lane deployments"}],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":1176619039,"owner_id":266652207,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":331114594,"repo":"chronicle/detection-rules","listed_as":"chronicle/detection-rules","name":"Chronicle (GCP) Detection Rules","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"Collection of example YARA-L rules for use within Google Security Operations","license":"Apache-2.0","stars":522,"archived":false,"last_commit":"2026-10-16T20:38:41Z","days_since_commit":3,"release":{"tag":"content-manager-v1.0.7","date":"2025-11-12T16:51:14Z","assets":0,"verification":null},"weeks":[0,0,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":331114594,"owner_id":69532429,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":null,"repo":"ExabeamLabs/Content-Library-CIM2","listed_as":"ExabeamLabs/Content-Library-CIM2","name":"Exabeam Content Library","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"","license":"","stars":0,"archived":false,"last_commit":null,"days_since_commit":null,"release":null,"weeks":null,"advisories":null,"status":"unavailable","signals":[],"checked":"2026-10-19T22:22:17Z","history":[{"date":"2026-10-19","type":"first_seen","status":"unavailable"}]},{"id":753190239,"repo":"anvilogic-forge/armory","listed_as":"anvilogic-forge/armory","name":"Anvilogic Detection Armory","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"Anvilogic Forge","license":"GPL-3.0","stars":119,"archived":false,"last_commit":"2026-03-31T12:19:58Z","days_since_commit":202,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":753190239,"owner_id":105012677,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":314027510,"repo":"center-for-threat-informed-defense/security-stack-mappings","listed_as":"center-for-threat-informed-defense/security-stack-mappings","name":"Center for Threat Informed Defense Security Stack Mappings","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.","license":"Apache-2.0","stars":388,"archived":true,"last_commit":"2024-04-03T16:45:24Z","days_since_commit":929,"release":{"tag":"v1.1.0","date":"2021-09-21T12:44:10Z","assets":4,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":314027510,"owner_id":57051716,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":480727617,"repo":"west-wind/Threat-Hunting-With-Splunk","listed_as":"west-wind/Threat-Hunting-With-Splunk","name":"Detection Engineering with Splunk","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise","license":"MIT","stars":69,"archived":false,"last_commit":"2026-07-02T13:09:14Z","days_since_commit":109,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,2,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":480727617,"owner_id":32312003,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":1246637312,"repo":"ridgelinecyberdefence/Enterprise-Detection-Engineering","listed_as":"ridgelinecyberdefence/Enterprise-Detection-Engineering","name":"Ridgeline Detection Library","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"Production-validated detection queries and hunting artifacts across 9 platforms (KQL, Sigma, Splunk, Athena, PowerShell, Velociraptor, YARA, Suricata, osquery). Each with triggers, false positives, tuning guidance, and validation steps.","license":"Apache-2.0","stars":11,"archived":false,"last_commit":"2026-07-28T08:22:35Z","days_since_commit":83,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,3,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1246637312,"owner_id":252557331,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":446990881,"repo":"GoogleCloudPlatform/security-analytics","listed_as":"GoogleCloudPlatform/security-analytics","name":"Google Cloud Security Analytics","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud","license":"Apache-2.0","stars":370,"archived":true,"last_commit":"2024-06-12T14:47:29Z","days_since_commit":859,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":446990881,"owner_id":2810941,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":498037475,"repo":"Bert-JanP/Hunting-Queries-Detection-Rules","listed_as":"Bert-JanP/Hunting-Queries-Detection-Rules","name":"KQL Advanced Hunting Queries & Analytics Rules","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules. ","license":"BSD-3-Clause","stars":1763,"archived":false,"last_commit":"2026-10-13T05:00:17Z","days_since_commit":6,"release":null,"weeks":[3,5,1,0,0,0,2,2,1,7,3,1,2,0,0,2,1,2,3,3,0,2,1,0,1,0,0,0,2,1,0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,2,0,1,1,1,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":498037475,"owner_id":91258706,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":1096888045,"repo":"Khadinxc/Sigma2KQL","listed_as":"Khadinxc/Sigma2KQL","name":"Sigma2KQL","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"Sigma Queries turned into KQL for Defender using pysigma - Automated","license":"","stars":5,"archived":false,"last_commit":"2026-10-12T01:36:10Z","days_since_commit":7,"release":{"tag":"2025_11_2_Sigma2KQL","date":"2025-11-15T07:20:34Z","assets":0,"verification":null},"weeks":[0,0,5,5,2,0,1,1,0,1,0,1,0,1,1,0,0,1,7,0,0,1,0,1,0,1,1,1,0,0,0,0,0,1,1,1,1,1,1,0,1,1,1,1,0,1,0,1,1,1,1,0],"advisories":[],"status":"active","signals":[{"type":"fork"},{"type":"no_license"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1096888045,"owner_id":89855993,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":1097373255,"repo":"Khadinxc/TerraSigma","listed_as":"Khadinxc/TerraSigma","name":"TerraSigma","category":"detection-engineering","subcategory":"Detection Content & Signatures","source":"awesome-detection-engineering","description":"TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel","license":"","stars":5,"archived":false,"last_commit":"2026-10-12T01:36:36Z","days_since_commit":7,"release":{"tag":"2025_11_2_TerraSigma","date":"2025-11-17T10:43:22Z","assets":0,"verification":null},"weeks":[0,0,0,23,2,1,1,1,0,1,0,1,1,1,0,1,0,1,11,1,0,5,0,0,1,0,0,1,1,0,0,0,0,0,1,1,0,1,0,1,1,0,1,1,0,0,1,0,1,0,1,0],"advisories":[],"status":"active","signals":[{"type":"no_license"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1097373255,"owner_id":89855993,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":503898036,"repo":"ExabeamLabs/CIMLibrary","listed_as":"ExabeamLabs/CIMLibrary","name":"Exabeam Common Information Model","category":"detection-engineering","subcategory":"Logging, Monitoring & Data Sources","source":"awesome-detection-engineering","description":"CIM Library","license":"Apache-2.0","stars":12,"archived":false,"last_commit":"2026-09-16T14:16:04Z","days_since_commit":33,"release":null,"weeks":[0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,0,0,1,0,0,0,0,0,1,0,0,0,1,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":503898036,"owner_id":39413988,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":60705895,"repo":"logpai/loghub","listed_as":"logpai/loghub","name":"Loghub","category":"detection-engineering","subcategory":"Logging, Monitoring & Data Sources","source":"awesome-detection-engineering","description":"A large collection of system log datasets for AI-driven log analytics [ISSRE'23]","license":"other","stars":2882,"archived":false,"last_commit":"2025-06-13T23:52:05Z","days_since_commit":492,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":60705895,"owner_id":23229062,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":27091760,"repo":"YelpArchive/elastalert","listed_as":"YelpArchive/elastalert","name":"Elastalert | Yelp","category":"detection-engineering","subcategory":"Logging, Monitoring & Data Sources","source":"awesome-detection-engineering","description":"Easy & Flexible Alerting With ElasticSearch","license":"Apache-2.0","stars":7981,"archived":false,"last_commit":"2022-11-12T00:59:45Z","days_since_commit":1437,"release":{"tag":"v0.0.52","date":"2015-06-25T22:12:51Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":27091760,"owner_id":8711918,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":1146898804,"repo":"Karib0u/rustinel","listed_as":"Karib0u/rustinel","name":"Rustinel | Karib0u","category":"detection-engineering","subcategory":"Logging, Monitoring & Data Sources","source":"awesome-detection-engineering","description":"Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.","license":"Apache-2.0","stars":507,"archived":false,"last_commit":"2026-10-19T20:17:04Z","days_since_commit":0,"release":{"tag":"v1.10.0","date":"2026-10-16T13:14:11Z","assets":7,"verification":"signature"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,3,10,3,3,0,3,0,0,0,0,0,1,1,0,7,22,7,1,19,8,7,7,14,18,9,9,10,0,15,13,24,46,49,44,25,42,36,36,34],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":1146898804,"owner_id":16960088,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":1135372712,"repo":"soctalk/soctalk","listed_as":"soctalk/soctalk","name":"SOCTalk","category":"detection-engineering","subcategory":"Logging, Monitoring & Data Sources","source":"awesome-detection-engineering","description":"AI-powered multi-tenant SOC automation agent using LangGraph with Wazuh, Cortex, TheHive & MISP integration","license":"Apache-2.0","stars":90,"archived":false,"last_commit":"2026-08-12T08:19:37Z","days_since_commit":68,"release":{"tag":"v0.2.1","date":"2026-08-12T07:44:04Z","assets":9,"verification":"checksum"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,2,0,7,5,1,0,0,0,0,0,0,0,0,0,0,0,11,16,0,47,6,40,8,3,14,46,126,81,12,65,77,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1135372712,"owner_id":282661524,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":27091760,"repo":"YelpArchive/elastalert","listed_as":"Yelp/elastalert","name":"ElastAlert","category":"detection-engineering","subcategory":"Detection, Alerting and Automation Platforms","source":"awesome-threat-detection","description":"Easy & Flexible Alerting With ElasticSearch","license":"Apache-2.0","stars":7981,"archived":false,"last_commit":"2022-11-12T00:59:45Z","days_since_commit":1437,"release":{"tag":"v0.0.52","date":"2015-06-25T22:12:51Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"Yelp/elastalert","to":"YelpArchive/elastalert"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":27091760,"owner_id":8711918,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":262044260,"repo":"Shuffle/Shuffle","listed_as":"Shuffle/Shuffle","name":"Shuffle","category":"detection-engineering","subcategory":"Detection, Alerting and Automation Platforms","source":"awesome-threat-detection","description":"Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.","license":"AGPL-3.0","stars":2459,"archived":false,"last_commit":"2026-09-28T14:41:32Z","days_since_commit":21,"release":{"tag":"v2.3.0","date":"2026-09-28T13:57:49Z","assets":0,"verification":null},"weeks":[20,10,19,6,15,35,6,7,3,0,6,13,8,6,1,41,0,6,2,4,6,6,1,6,8,2,6,15,20,0,3,3,1,0,4,3,3,11,15,5,7,14,3,8,18,23,16,26,4,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":262044260,"owner_id":74708781,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":358946307,"repo":"sublime-security/sublime-platform","listed_as":"sublime-security/sublime-platform","name":"Sublime","category":"detection-engineering","subcategory":"Detection, Alerting and Automation Platforms","source":"awesome-threat-detection","description":"A free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing. Gain visibility and control, hunt for advanced threats, collaborate with the community, and write detections-as-code.","license":"MIT","stars":276,"archived":false,"last_commit":"2026-10-19T19:36:27Z","days_since_commit":0,"release":null,"weeks":[0,0,0,0,0,0,1,1,0,0,0,0,1,0,0,0,2,1,0,2,0,2,0,1,1,0,0,2,1,1,1,4,0,0,0,1,0,1,0,1,1,0,0,0,0,1,5,0,1,1,0,1],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":358946307,"owner_id":47514260,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":481983343,"repo":"brexhq/substation","listed_as":"brexhq/substation","name":"Substation","category":"detection-engineering","subcategory":"Detection, Alerting and Automation Platforms","source":"awesome-threat-detection","description":"Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.","license":"MIT","stars":407,"archived":false,"last_commit":"2026-10-16T17:26:24Z","days_since_commit":3,"release":{"tag":"v2.9.0","date":"2026-10-16T17:26:41Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,1,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":481983343,"owner_id":26666889,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":64099814,"repo":"kolide/fleet","listed_as":"kolide/fleet","name":"Kolide Fleet","category":"detection-engineering","subcategory":"Endpoint Monitoring","source":"awesome-threat-detection","description":"A flexible control server for osquery fleets","license":"MIT","stars":1098,"archived":true,"last_commit":"2020-12-15T15:03:20Z","days_since_commit":2134,"release":{"tag":"3.2.0","date":"2020-10-08T19:27:09Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[{"id":"GHSA-6g7f-8qm4-f7h8","cve":"","severity":"low","published":"2019-05-30","summary":"Fleet may expose SMTP credentials over insecure connection when LOGIN authentication is used"}],"status":"archived","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":64099814,"owner_id":19914378,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":203790044,"repo":"zeek/zeek-agent","listed_as":"zeek/zeek-agent","name":"Zeek Agent","category":"detection-engineering","subcategory":"Endpoint Monitoring","source":"awesome-threat-detection","description":"This project is no longer maintained. There's a successor at https://github.com/zeek/zeek-agent-v2","license":"other","stars":122,"archived":true,"last_commit":"2020-11-19T07:40:54Z","days_since_commit":2160,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":203790044,"owner_id":1194067,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":15926180,"repo":"draios/sysdig","listed_as":"draios/sysdig","name":"Sysdig","category":"detection-engineering","subcategory":"Endpoint Monitoring","source":"awesome-threat-detection","description":"Linux system exploration and troubleshooting tool with first class support for containers","license":"other","stars":8305,"archived":false,"last_commit":"2026-04-13T12:32:03Z","days_since_commit":189,"release":{"tag":"0.41.4","date":"2026-01-29T12:17:41Z","assets":9,"verification":"none"},"weeks":[0,0,2,0,6,6,3,3,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":15926180,"owner_id":5068817,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":73417046,"repo":"slackhq/go-audit","listed_as":"slackhq/go-audit","name":"go-audit","category":"detection-engineering","subcategory":"Endpoint Monitoring","source":"awesome-threat-detection","description":"go-audit is an alternative to the auditd daemon that ships with many distros","license":"MIT","stars":1666,"archived":false,"last_commit":"2026-09-08T16:17:34Z","days_since_commit":41,"release":{"tag":"v1.2.2","date":"2026-06-22T16:57:28Z","assets":0,"verification":null},"weeks":[0,0,0,1,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,7,0,0,0,1,3,1,0,0,2,0,2,1,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":73417046,"owner_id":6911160,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":308092559,"repo":"microsoft/Sysmon-Linux","listed_as":"Sysinternals/SysmonForLinux","name":"Sysmon for Linux","category":"detection-engineering","subcategory":"Endpoint Monitoring","source":"awesome-threat-detection","description":"Sysmon for Linux","license":"MIT","stars":2168,"archived":false,"last_commit":"2026-09-14T16:21:35Z","days_since_commit":35,"release":{"tag":"1.5.3","date":"2026-09-10T17:37:41Z","assets":6,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,1,0,1,0,0,0,1,0,1,0,6,0,0,0,0,0,0,0,0,1,0,0,1,0,0,0,0,0,0,0,2,1,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"Sysinternals/SysmonForLinux","to":"microsoft/Sysmon-Linux"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":308092559,"owner_id":6154722,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":12901559,"repo":"ossec/ossec-hids","listed_as":"ossec/ossec-hids","name":"OSSEC","category":"detection-engineering","subcategory":"Endpoint Monitoring","source":"awesome-threat-detection","description":"OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.","license":"GPL-2.0","stars":5067,"archived":false,"last_commit":"2026-10-18T20:09:53Z","days_since_commit":1,"release":{"tag":"4.4.1","date":"2026-10-18T17:27:28Z","assets":2,"verification":"signature"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,34,8,4,12,0,0,0,8,2,16,0,4,0,1,0,0,0,0,3,8,2,0,13,13,0,1,3,0,69,16,0,11,0,0,2,0,0,68,20,3],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":12901559,"owner_id":5479983,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":40556106,"repo":"wazuh/wazuh","listed_as":"wazuh/wazuh","name":"WAZUH","category":"detection-engineering","subcategory":"Endpoint Monitoring","source":"awesome-threat-detection","description":"Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.","license":"other","stars":17339,"archived":false,"last_commit":"2026-10-19T22:03:19Z","days_since_commit":0,"release":{"tag":"v4.14.9","date":"2026-10-15T17:40:40Z","assets":0,"verification":null},"weeks":[129,129,123,103,71,99,97,100,108,43,108,147,104,123,133,151,115,150,126,202,219,175,105,188,174,123,101,125,168,129,110,155,157,95,181,214,131,143,190,192,252,268,274,405,367,323,451,402,425,455,312,20],"advisories":[{"id":"GHSA-cjf8-wjx6-hjw6","cve":"CVE-2026-74041","severity":"critical","published":"2026-10-13","summary":"Case-sensitivity mismatch bypasses remote-command validation, allowing command execution as root"},{"id":"GHSA-vc33-wcqf-cwgv","cve":"CVE-2026-74033","severity":"medium","published":"2026-10-13","summary":"Missing destination-path validation in CDB list cluster-callable handlers allows arbitrary file read/delete on the manager"},{"id":"GHSA-3xm6-wp5v-2fm9","cve":"CVE-2026-74037","severity":"high","published":"2026-10-13","summary":"Improper session invalidation in check_token: revoking a run_as user's administrator grant does not invalidate their token, enabling permanent self-re-grant of administrator"},{"id":"GHSA-27gv-q7q6-f5qh","cve":"CVE-2026-74035","severity":"high","published":"2026-10-13","summary":"An empty password bypasses both the password policy and the reserved user guard in `security.update_user`, allowing a delegated user administrator to take over the `wazuh` superuser account"},{"id":"GHSA-gc4j-j9fg-4cfr","cve":"CVE-2026-74045","severity":"high","published":"2026-10-13","summary":"Heap buffer overflow in wazuh-analysisd fim_generate_alert() lets an enrolled agent corrupt manager heap memory and terminate the analysis engine"},{"id":"GHSA-crrg-5qvw-8wjx","cve":"CVE-2026-93346","severity":"medium","published":"2026-10-13","summary":"API brute-force protection is still bypassable by concurrent login requests, the `asyncio.Lock` fix for GHSA-m2mr-xhhv-jx58 serializes the counter but does not close the check-then-count race"},{"id":"GHSA-qmhg-366r-jjfp","cve":"CVE-2026-74036","severity":"high","published":"2026-10-13","summary":"Remote code execution as root on Wazuh agents via SCA command policies"},{"id":"GHSA-xrjw-cqrv-j92g","cve":"CVE-2026-93347","severity":"medium","published":"2026-10-13","summary":"Path traversal in cluster-callable get_list_file allows arbitrary file read as the wazuh user"},{"id":"GHSA-w4qc-m4j4-6m9c","cve":"CVE-2026-74031","severity":"medium","published":"2026-10-13","summary":"Path traversal in cluster-callable rule/decoder delete helpers allows arbitrary file deletion as the wazuh user"},{"id":"GHSA-r7hm-43xr-477j","cve":"CVE-2026-74034","severity":"high","published":"2026-10-13","summary":"Arbitrary file read as root via agent-injected upgrade_custom command"},{"id":"GHSA-qj8j-r988-54rx","cve":"CVE-2026-74047","severity":"medium","published":"2026-10-13","summary":"authd.pass disclosed to low-privileged users through the per-agent active configuration endpoint"},{"id":"GHSA-vh8p-3xvw-w536","cve":"CVE-2026-74032","severity":"medium","published":"2026-10-13","summary":"RBAC Authorization Bypass in Wazuh API"},{"id":"GHSA-88p6-7cm8-xwj8","cve":"CVE-2026-74040","severity":"critical","published":"2026-10-13","summary":"Cluster worker can overwrite arbitrary master files (incl. ossec.conf) → root RCE on manager and every agent — bypass of #36296 excluded_files guard + missing extra_valid enforcement"},{"id":"GHSA-cw26-jj8q-x7w5","cve":"CVE-2026-74043","severity":"critical","published":"2026-10-13","summary":"Path traversal in cluster-callable upload functions allows arbitrary file write as the wazuh user"},{"id":"GHSA-x8v7-g49q-ff7j","cve":"CVE-2026-74030","severity":"medium","published":"2026-10-13","summary":"SCA YAML alias expansion causes memory exhaustion"},{"id":"GHSA-whhr-gxxr-f6pm","cve":"CVE-2026-62365","severity":"medium","published":"2026-08-18","summary":"Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML"},{"id":"GHSA-9wv5-7qwx-m9w5","cve":"CVE-2026-61811","severity":"medium","published":"2026-08-18","summary":"Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion"},{"id":"GHSA-vjcq-cf36-f5gx","cve":"CVE-2026-61783","severity":"high","published":"2026-08-18","summary":"RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key"},{"id":"GHSA-chmg-89pf-2q82","cve":"CVE-2026-61802","severity":"medium","published":"2026-08-18","summary":"Cluster authentication key disclosed to low-privilege cluster:read API users via GET /cluster/local/config (missing mask_sensitive_config) — enables cluster-peer RCE chain"},{"id":"GHSA-3jff-488g-335f","cve":"CVE-2026-61800","severity":"high","published":"2026-08-18","summary":"Incomplete fix for CVE-2026-30893: missing directory confinement in cluster worker file sync allows arbitrary file write under /var/ossec on worker nodes"}],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":40556106,"owner_id":13752566,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":78612417,"repo":"MHaggis/sysmon-dfir","listed_as":"MHaggis/sysmon-dfir","name":"sysmon-DFIR","category":"detection-engineering","subcategory":"Configuration","source":"awesome-threat-detection","description":"Sources, configuration and how to detect evil things utilizing Microsoft Sysmon. ","license":"GPL-3.0","stars":946,"archived":false,"last_commit":"2023-12-12T16:21:02Z","days_since_commit":1042,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":78612417,"owner_id":5632822,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":80652174,"repo":"SwiftOnSecurity/sysmon-config","listed_as":"SwiftOnSecurity/sysmon-config","name":"sysmon-config","category":"detection-engineering","subcategory":"Configuration","source":"awesome-threat-detection","description":"Sysmon configuration file template with default high-quality event tracing","license":"","stars":5697,"archived":false,"last_commit":"2021-10-17T01:19:08Z","days_since_commit":1828,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":80652174,"owner_id":25470060,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":117379388,"repo":"olafhartong/sysmon-modular","listed_as":"olafhartong/sysmon-modular","name":"sysmon-modular","category":"detection-engineering","subcategory":"Configuration","source":"awesome-threat-detection","description":"A repository of sysmon configuration modules","license":"MIT","stars":3160,"archived":false,"last_commit":"2026-10-14T08:50:06Z","days_since_commit":5,"release":{"tag":"configs-a45dedb13a43","date":"2026-10-14T08:51:38Z","assets":23,"verification":"checksum"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,8,0,0,0,1,3,3,1,5,2,0,1,7,0,0],"advisories":[],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":117379388,"owner_id":8149899,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":150223220,"repo":"Neo23x0/auditd","listed_as":"Neo23x0/auditd","name":"auditd configuration","category":"detection-engineering","subcategory":"Configuration","source":"awesome-threat-detection","description":"Best Practice Auditd Configuration","license":"Apache-2.0","stars":1957,"archived":false,"last_commit":"2026-05-04T12:02:04Z","days_since_commit":168,"release":{"tag":"v0.2.0","date":"2026-04-21T18:12:39Z","assets":0,"verification":null},"weeks":[0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,7,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":150223220,"owner_id":2851492,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":110026610,"repo":"palantir/osquery-configuration","listed_as":"palantir/osquery-configuration","name":"osquery-configuration","category":"detection-engineering","subcategory":"Configuration","source":"awesome-threat-detection","description":"A repository for using osquery for incident detection and response","license":"other","stars":906,"archived":false,"last_commit":"2020-03-26T18:43:58Z","days_since_commit":2398,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":110026610,"owner_id":303157,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":4930716,"repo":"zeek/zeek","listed_as":"zeek/zeek","name":"Zeek","category":"network-monitoring","subcategory":"Network Monitoring","source":"awesome-threat-detection","description":"Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.","license":"other","stars":8120,"archived":false,"last_commit":"2026-10-19T17:27:26Z","days_since_commit":0,"release":{"tag":"v9.0.0","date":"2026-08-21T20:24:47Z","assets":2,"verification":"signature"},"weeks":[30,38,62,39,34,54,52,27,0,15,54,35,16,26,30,4,12,20,37,66,15,10,45,58,79,55,43,54,35,37,36,75,72,60,45,28,72,58,44,58,50,31,91,40,35,22,23,28,14,28,40,1],"advisories":[{"id":"GHSA-694c-w947-hm9j","cve":"","severity":"high","published":"2026-09-03","summary":"MIME: Analyzer allows headers to grow without bound in HTTP/SMTP"},{"id":"GHSA-2xc9-g36m-w7jh","cve":"","severity":"high","published":"2026-08-19","summary":"SMB: Chains of AndX messages can crash Zeek"},{"id":"GHSA-px95-jfxw-4jw2","cve":"","severity":"high","published":"2026-08-19","summary":"DNP3: Memory exhaustion via file control (g70v1) fields"},{"id":"GHSA-wjf9-326g-m9h3","cve":"","severity":"high","published":"2026-08-19","summary":"SIP: Memory exhaustion from long request/response paths"},{"id":"GHSA-hxj7-pcq9-c949","cve":"","severity":"high","published":"2026-08-19","summary":"DHCP: Memory exhaustion from retained options after analyzer violation"},{"id":"GHSA-49x5-fmqq-4ccv","cve":"","severity":"high","published":"2026-08-19","summary":"SMTP: Memory exhaustion from large numbers of rcptto/to/cc/path entries "},{"id":"GHSA-qjhc-rfmf-3vgp","cve":"","severity":"medium","published":"2026-08-19","summary":"Telnet: AUTH STATUS options before a NAME is received results in event argument mismatch"},{"id":"GHSA-rmc2-mqq6-wcw9","cve":"","severity":"high","published":"2026-08-19","summary":"SMB: DCE/RPC memory exhaustion from fragment state"},{"id":"GHSA-q48f-3qm2-j875","cve":"","severity":"medium","published":"2026-08-19","summary":"UDP: udp_contents events could trigger out-of-bounds reads"},{"id":"GHSA-3gxr-8f49-vrgr","cve":"","severity":"high","published":"2026-08-19","summary":"Analyzer manager: Equivalent scheduled analyzers could exhaust memory"},{"id":"GHSA-gq9q-85wf-mq48","cve":"","severity":"medium","published":"2026-08-19","summary":"NetBIOS: Memory exhaustion from declared session lengths"},{"id":"GHSA-c573-w89f-fpxm","cve":"","severity":"high","published":"2026-08-19","summary":"Redis: Parsed Redis traffic memory exhaustion"},{"id":"GHSA-84jg-cwr7-4p6w","cve":"","severity":"high","published":"2026-08-19","summary":"Invalid IPv6 fragments can lead to unbounded state growth"},{"id":"GHSA-5v93-pm35-5mq6","cve":"","severity":"high","published":"2026-08-19","summary":"SSH: Quadratic KEX algorithm CPU exhaustion"},{"id":"GHSA-hww6-p5xp-6rqv","cve":"","severity":"high","published":"2026-08-19","summary":"NVT: Oversized line recovery writes before heap buffer"},{"id":"GHSA-qf53-234m-7vhq","cve":"","severity":"high","published":"2026-08-19","summary":"DHCP: Unbounded state growth via join_data"},{"id":"GHSA-9m23-gwjx-p3j8","cve":"","severity":"high","published":"2026-08-19","summary":"FTP: Unbounded state growth via ftp_data_expected"},{"id":"GHSA-j48p-9pm3-pgpx","cve":"","severity":"high","published":"2026-08-19","summary":"OCSP: Empty byName responder ID crashes Zeek"},{"id":"GHSA-924m-g9gv-45xc","cve":"","severity":"high","published":"2026-08-19","summary":"ARP: Tunneled ARP traffic crashes Zeek"},{"id":"GHSA-6566-755c-7mwq","cve":"","severity":"medium","published":"2026-08-19","summary":"IRC: Single DCC Send packet can result in scripting error"}],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":4930716,"owner_id":1194067,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":34847907,"repo":"ntop/ntopng","listed_as":"ntop/ntopng","name":"ntopng","category":"network-monitoring","subcategory":"Network Monitoring","source":"awesome-threat-detection","description":"Web-based Traffic and Cybersecurity Network Traffic Monitoring","license":"GPL-3.0","stars":8273,"archived":false,"last_commit":"2026-10-19T14:53:32Z","days_since_commit":0,"release":{"tag":"7.0","date":"2026-09-22T16:17:31Z","assets":0,"verification":null},"weeks":[26,53,46,42,23,40,29,19,12,30,23,39,45,32,74,23,46,57,39,62,62,70,57,53,69,32,28,33,64,54,44,39,26,42,54,79,32,94,60,46,73,118,41,66,53,41,43,52,51,65,36,7],"advisories":[{"id":"GHSA-5xr5-wqhx-fpxm","cve":"","severity":"high","published":"2026-10-08","summary":"An sFlow datagram with an unbounded MPLS label-stack depth reads past the buffer"},{"id":"GHSA-89wv-w893-9fvq","cve":"","severity":"high","published":"2026-10-08","summary":"Stored XSS via network-harvested host names in the Hosts view"},{"id":"GHSA-7gqm-qqf6-8wxq","cve":"","severity":"high","published":"2026-09-23","summary":"[XBOW-025-118] Cross-Site Scripting in ntopng Login Page Using RTL Override"},{"id":"GHSA-p4gm-6qx7-gq3m","cve":"","severity":"medium","published":"2026-08-03","summary":"OS command injection in vulnerability scan exec_netscan via host parameter (incomplete fix bypass)"},{"id":"GHSA-26jm-9qfw-89w7","cve":"CVE-2026-97371","severity":"medium","published":"2026-07-21","summary":"Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets"},{"id":"GHSA-43p9-5758-wwq8","cve":"CVE-2026-84989","severity":"high","published":"2026-07-17","summary":"Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags"},{"id":"GHSA-7gqc-vjwr-6rh5","cve":"CVE-2026-84990","severity":"high","published":"2026-07-17","summary":"Missing Authorization on System Configuration Backup Download and Listing"},{"id":"GHSA-2c6p-4pfj-qv58","cve":"CVE-2026-82412","severity":"high","published":"2026-07-16","summary":"Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API"},{"id":"GHSA-9xj6-f266-r46p","cve":"CVE-2026-82413","severity":"high","published":"2026-07-16","summary":"Authenticated (Non-Admin) Users Can Run Vulnerability-Scan"},{"id":"GHSA-m22w-f647-vx88","cve":"","severity":"high","published":"2026-07-16","summary":"Missing Authorization in REST API Allows Non-Admin Users to Delete All Notification Endpoints, Recipients, and Host Pools"},{"id":"GHSA-ffg5-889g-f5q8","cve":"CVE-2026-83621","severity":"high","published":"2026-07-16","summary":"Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs"}],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":34847907,"owner_id":12014789,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":49294674,"repo":"cisco/joy","listed_as":"cisco/joy","name":"Joy","category":"network-monitoring","subcategory":"Network Monitoring","source":"awesome-threat-detection","description":"A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.","license":"other","stars":1367,"archived":true,"last_commit":"2019-11-08T15:26:59Z","days_since_commit":2537,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":49294674,"owner_id":1376999,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":159568339,"repo":"dreadl0ck/netcap","listed_as":"dreadl0ck/netcap","name":"Netcap","category":"network-monitoring","subcategory":"Network Monitoring","source":"awesome-threat-detection","description":"A framework for secure and scalable network traffic analysis - https://netcap.io","license":"GPL-3.0","stars":1810,"archived":false,"last_commit":"2026-10-18T20:48:34Z","days_since_commit":1,"release":{"tag":"v0.13.0","date":"2026-10-09T18:26:08Z","assets":9,"verification":"checksum"},"weeks":[17,7,1,7,39,14,0,0,18,0,0,0,0,0,0,0,0,0,0,0,1,0,10,24,0,0,18,0,2,22,0,7,0,1,0,0,0,0,0,0,0,0,10,7,31,21,3,92,12,87,0,3],"advisories":[],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":159568339,"owner_id":25550963,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":4927517,"repo":"arkime/arkime","listed_as":"arkime/arkime","name":"Arkime","category":"network-monitoring","subcategory":"Network Monitoring","source":"awesome-threat-detection","description":"Arkime is an open source, large scale, full packet capturing, indexing, and database system.","license":"Apache-2.0","stars":7536,"archived":false,"last_commit":"2026-10-19T19:27:10Z","days_since_commit":0,"release":{"tag":"v6.8.0","date":"2026-09-30T12:42:40Z","assets":28,"verification":"none"},"weeks":[2,1,0,3,0,13,14,9,2,6,12,11,21,48,21,24,23,24,28,18,22,16,17,27,17,8,26,23,14,14,9,7,16,13,14,12,18,12,18,13,8,19,7,6,12,5,9,5,22,26,16,3],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":4927517,"owner_id":71138764,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":25178571,"repo":"google/stenographer","listed_as":"google/stenographer","name":"Stenographer","category":"network-monitoring","subcategory":"Network Monitoring","source":"awesome-threat-detection","description":"Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets.  Discussion/announcements at stenographer@googlegroups.com","license":"Apache-2.0","stars":1796,"archived":true,"last_commit":"2020-11-30T16:29:44Z","days_since_commit":2149,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":25178571,"owner_id":1342004,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":94265371,"repo":"salesforce/ja3","listed_as":"salesforce/ja3","name":"JA3","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.","license":"BSD-3-Clause","stars":3096,"archived":true,"last_commit":"2025-05-01T17:30:05Z","days_since_commit":536,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":94265371,"owner_id":453694,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":149488482,"repo":"salesforce/hassh","listed_as":"salesforce/hassh","name":"HASSH","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.","license":"BSD-3-Clause","stars":554,"archived":true,"last_commit":"2025-05-01T17:29:53Z","days_since_commit":536,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":149488482,"owner_id":453694,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":242868677,"repo":"theparanoids/rdfp","listed_as":"yahoo/rdfp","name":"RDFP","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"Remote Desktop Client Fingerprint script for Zeek. Based off of https://github.com/0x4D31/fatt","license":"Apache-2.0","stars":40,"archived":false,"last_commit":"2020-05-15T18:22:51Z","days_since_commit":2348,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"yahoo/rdfp","to":"theparanoids/rdfp"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":242868677,"owner_id":4968187,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":176398139,"repo":"0x4D31/fatt","listed_as":"0x4D31/fatt","name":"FATT","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"FATT /fingerprintAllTheThings - a pyshark based script for extracting network metadata and fingerprints from pcap files and live network traffic","license":"BSD-3-Clause","stars":684,"archived":false,"last_commit":"2022-03-23T01:45:36Z","days_since_commit":1671,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":176398139,"owner_id":11577776,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":42449861,"repo":"LeeBrotherston/tls-fingerprinting","listed_as":"LeeBrotherston/tls-fingerprinting","name":"FingerprinTLS","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"TLS Fingerprinting","license":"GPL-3.0","stars":399,"archived":true,"last_commit":"2020-09-08T23:57:44Z","days_since_commit":2231,"release":{"tag":"1.0.1","date":"2016-07-31T04:41:11Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":42449861,"owner_id":6254777,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":205461953,"repo":"cisco/mercury","listed_as":"cisco/mercury","name":"Mercury","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"Mercury: network metadata capture and analysis","license":"other","stars":520,"archived":false,"last_commit":"2026-09-23T18:24:40Z","days_since_commit":26,"release":null,"weeks":[27,25,36,16,15,35,17,20,2,0,11,20,24,22,26,54,50,76,47,51,6,24,14,57,66,40,23,12,25,28,6,12,23,8,21,11,18,22,16,8,30,14,43,21,32,53,64,48,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":205461953,"owner_id":1376999,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":201530694,"repo":"salesforce/GQUIC_Protocol_Analyzer","listed_as":"salesforce/GQUIC_Protocol_Analyzer","name":"GQUIC Protocol Analyzer for Zeek","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"GQUIC Protocol Analyzer for Zeek (Bro) Network Security Monitor","license":"other","stars":83,"archived":false,"last_commit":"2026-08-13T17:57:30Z","days_since_commit":67,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":201530694,"owner_id":453694,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":15459617,"repo":"rapid7/recog","listed_as":"rapid7/recog","name":"Recog","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"Pattern recognition for hosts, services, and content","license":"other","stars":795,"archived":false,"last_commit":"2026-10-12T07:05:44Z","days_since_commit":7,"release":{"tag":"v3.3.2","date":"2026-10-12T07:08:32Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,1,1,0,0,0,0,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,2,6,0,0,0,2,2,13,3,0,3,3,1,0,0,0,0,0,0,3,0,1,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":15459617,"owner_id":1013671,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":294107626,"repo":"CERT-Polska/hfinger","listed_as":"CERT-Polska/hfinger","name":"Hfinger","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"Hfinger - fingerprinting HTTP requests","license":"GPL-3.0","stars":148,"archived":false,"last_commit":"2023-05-16T10:58:05Z","days_since_commit":1252,"release":{"tag":"v0.2.2","date":"2023-05-16T11:04:24Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":294107626,"owner_id":1210616,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":278482508,"repo":"salesforce/jarm","listed_as":"salesforce/jarm","name":"JARM","category":"network-monitoring","subcategory":"Fingerprinting Tools","source":"awesome-threat-detection","description":"","license":"BSD-3-Clause","stars":1326,"archived":false,"last_commit":"2026-08-13T17:58:03Z","days_since_commit":67,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":278482508,"owner_id":453694,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":273084758,"repo":"elastic/detection-rules","listed_as":"elastic/detection-rules","name":"Elastic Detection Rules","category":"detection-engineering","subcategory":"Detection Rules","source":"awesome-threat-detection","description":"","license":"other","stars":2725,"archived":false,"last_commit":"2026-10-19T19:50:33Z","days_since_commit":0,"release":{"tag":"dev-v3.0.0","date":"2026-09-25T21:06:52Z","assets":0,"verification":null},"weeks":[3,5,32,11,29,45,25,29,2,4,26,14,15,33,26,17,28,20,7,19,17,26,7,25,0,20,39,32,21,23,22,29,2,25,31,34,23,35,22,45,26,10,12,36,13,38,32,12,41,27,3,2],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":273084758,"owner_id":6764390,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":86409009,"repo":"OTRF/ThreatHunter-Playbook","listed_as":"OTRF/ThreatHunter-Playbook","name":"ThreatHunter-Playbook","category":"detection-engineering","subcategory":"Detection Rules","source":"awesome-threat-detection","description":"A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.","license":"MIT","stars":4690,"archived":false,"last_commit":"2025-12-30T04:57:02Z","days_since_commit":293,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":86409009,"owner_id":59928038,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":340478300,"repo":"sublime-security/sublime-rules","listed_as":"sublime-security/sublime-rules","name":"Sublime Detection Rules","category":"detection-engineering","subcategory":"Detection Rules","source":"awesome-threat-detection","description":"Sublime rules for email attack detection, prevention, and threat hunting.","license":"MIT","stars":380,"archived":false,"last_commit":"2026-10-19T18:49:54Z","days_since_commit":0,"release":null,"weeks":[18,36,15,27,14,44,24,25,1,0,15,14,31,31,32,27,16,21,24,32,29,24,29,25,24,26,43,22,18,30,33,52,30,39,39,36,43,43,19,37,59,38,52,53,57,45,60,53,71,75,29,6],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":340478300,"owner_id":47514260,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":69969485,"repo":"retracedhq/retraced","listed_as":"retracedhq/retraced","name":"BoxyHQ","category":"network-monitoring","subcategory":"Monitoring / Logging","source":"awesome-security","description":"🔥 A fully open source audit logs service and embeddable UI easily deployed to your own Kubernetes cluster. Brought to you by replicated.com and boxyhq.com  🚀","license":"Apache-2.0","stars":451,"archived":false,"last_commit":"2025-08-26T16:18:58Z","days_since_commit":419,"release":{"tag":"v1.13.1","date":"2024-11-06T11:56:27Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":69969485,"owner_id":11219941,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":1679745,"repo":"gamelinux/passivedns","listed_as":"gamelinux/passivedns","name":"passivedns","category":"network-monitoring","subcategory":"Monitoring / Logging","source":"awesome-security","description":"A network sniffer that logs all DNS server replies for use in a passive DNS setup","license":"other","stars":1736,"archived":false,"last_commit":"2026-10-18T16:22:52Z","days_since_commit":1,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,23,2],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1679745,"owner_id":53898,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":88417028,"repo":"evilsocket/opensnitch","listed_as":"evilsocket/opensnitch","name":"opensnitch","category":"network-monitoring","subcategory":"Monitoring / Logging","source":"awesome-security","description":"OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.","license":"GPL-3.0","stars":14184,"archived":false,"last_commit":"2026-07-26T23:33:38Z","days_since_commit":84,"release":{"tag":"v1.8.0","date":"2025-12-15T00:54:11Z","assets":13,"verification":"signature"},"weeks":[0,0,9,5,22,13,25,19,9,20,8,21,11,10,15,4,10,5,9,15,0,1,0,0,4,0,0,0,0,1,0,0,4,10,3,2,11,0,8,1,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":88417028,"owner_id":86922,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":932314,"repo":"tenzir/tenzir","listed_as":"tenzir/vast","name":"VAST","category":"network-monitoring","subcategory":"Monitoring / Logging","source":"awesome-security","description":"Tenzir is the data pipeline engine for security teams.","license":"BSD-3-Clause","stars":765,"archived":false,"last_commit":"2026-10-19T21:16:23Z","days_since_commit":0,"release":{"tag":"v6.19.1","date":"2026-09-30T14:17:25Z","assets":10,"verification":"checksum"},"weeks":[42,83,59,38,28,41,42,116,69,56,90,118,147,175,148,139,330,255,146,126,124,95,98,52,113,65,90,86,58,49,29,32,50,23,59,58,22,33,24,7,17,50,62,62,38,94,29,110,148,62,49,8],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"tenzir/vast","to":"tenzir/tenzir"},{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":932314,"owner_id":29048253,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":1102921062,"repo":"Khadinxc/Sigma2SPL","listed_as":"Khadinxc/Sigma2SPL","name":"Sigma2SPL","category":"network-monitoring","subcategory":"Monitoring / Logging","source":"awesome-security","description":"Sigma Queries turned into SPL for Splunk Enterprise and Enterprise Security using pysigma - Automated ","license":"","stars":1,"archived":false,"last_commit":"2026-10-12T01:36:24Z","days_since_commit":7,"release":null,"weeks":[0,0,0,0,9,1,1,1,0,1,0,1,0,1,1,1,1,1,3,0,0,1,0,1,0,1,1,1,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,0,7,0,1,1,1,1,0],"advisories":[],"status":"active","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1102921062,"owner_id":89855993,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":442491504,"repo":"corelight/zeek2es","listed_as":"corelight/zeek2es","name":"zeek2es","category":"network-monitoring","subcategory":"IDS / IPS / Host IDS / Host IPS","source":"awesome-security","description":"A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio.  This app can also output pure JSON logs to stdout for further processing!","license":"BSD-3-Clause","stars":41,"archived":false,"last_commit":"2022-08-18T13:22:29Z","days_since_commit":1523,"release":{"tag":"v0.3.15","date":"2022-08-18T13:23:41Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":442491504,"owner_id":21672558,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":9994710,"repo":"marshyski/sshwatch","listed_as":"marshyski/sshwatch","name":"sshwatch","category":"network-monitoring","subcategory":"IDS / IPS / Host IDS / Host IPS","source":"awesome-security","description":"Intrusion Prevention System (IPS) for Secure Shell (SSH)","license":"","stars":55,"archived":false,"last_commit":"2013-07-21T23:12:59Z","days_since_commit":4837,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":9994710,"owner_id":3740784,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":264154402,"repo":"crowdsecurity/crowdsec","listed_as":"crowdsecurity/crowdsec","name":"CrowdSec","category":"network-monitoring","subcategory":"IDS / IPS / Host IDS / Host IPS","source":"awesome-security","description":"Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.","license":"MIT","stars":15223,"archived":false,"last_commit":"2026-10-19T15:05:16Z","days_since_commit":0,"release":{"tag":"v1.8.1","date":"2026-09-03T09:08:57Z","assets":5,"verification":"none"},"weeks":[10,8,13,18,14,4,14,26,0,0,13,16,16,18,20,6,10,8,15,1,18,5,13,3,1,0,9,6,1,2,0,1,0,0,0,7,19,2,15,6,5,11,10,7,4,5,6,5,14,13,9,3],"advisories":[{"id":"GHSA-rh69-4vqj-9gj8","cve":"","severity":"medium","published":"2026-08-31","summary":"Unbounded request-body read in kubernetes-audit acquisition webhook (memory-exhaustion DoS)"},{"id":"GHSA-g2x2-jgfg-pg7g","cve":"","severity":"medium","published":"2026-08-31","summary":"HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length"},{"id":"GHSA-rw47-hm26-6wr7","cve":"CVE-2026-44982","severity":"high","published":"2026-05-27","summary":"CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests"},{"id":"GHSA-273h-gvwr-c3qj","cve":"CVE-2026-44981","severity":"medium","published":"2026-05-27","summary":"CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression"}],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":264154402,"owner_id":63284097,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":3889407,"repo":"simsong/tcpflow","listed_as":"simsong/tcpflow","name":"tcpflow","category":"network-monitoring","subcategory":"Full Packet Capture / Forensic","source":"awesome-security","description":"TCP/IP packet demultiplexer. Download from:","license":"GPL-3.0","stars":1778,"archived":false,"last_commit":"2026-01-29T22:18:29Z","days_since_commit":263,"release":{"tag":"tcpflow-1.6.1","date":"2021-02-19T06:00:12Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[{"id":"GHSA-q5q6-frrv-9rj6","cve":"CVE-2026-25061","severity":"medium","published":"2026-01-29","summary":"TIM Element OOB Write in wifipcap"}],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":3889407,"owner_id":1594284,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":474043179,"repo":"deepfence/PacketStreamer","listed_as":"deepfence/PacketStreamer","name":"Deepfence PacketStreamer","category":"network-monitoring","subcategory":"Full Packet Capture / Forensic","source":"awesome-security","description":":star: :star: Distributed tcpdump for cloud native environments :star: :star:","license":"Apache-2.0","stars":1934,"archived":true,"last_commit":"2023-10-19T18:43:47Z","days_since_commit":1096,"release":{"tag":"v0.1.0","date":"2022-06-23T00:39:40Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":474043179,"owner_id":35167630,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":4927517,"repo":"arkime/arkime","listed_as":"aol/moloch","name":"Moloch","category":"network-monitoring","subcategory":"Full Packet Capture / Forensic","source":"awesome-security","description":"Arkime is an open source, large scale, full packet capturing, indexing, and database system.","license":"Apache-2.0","stars":7536,"archived":false,"last_commit":"2026-10-19T19:27:10Z","days_since_commit":0,"release":{"tag":"v6.8.0","date":"2026-09-30T12:42:40Z","assets":28,"verification":"none"},"weeks":[2,1,0,3,0,13,14,9,2,6,12,11,21,48,21,24,23,24,28,18,22,16,17,27,17,8,26,23,14,14,9,7,16,13,14,12,18,12,18,13,8,19,7,6,12,5,9,5,22,26,16,3],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"aol/moloch","to":"arkime/arkime"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":4927517,"owner_id":71138764,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":28135622,"repo":"USArmyResearchLab/Dshell","listed_as":"USArmyResearchLab/Dshell","name":"Dshell","category":"network-monitoring","subcategory":"Full Packet Capture / Forensic","source":"awesome-security","description":"Dshell is a network forensic analysis framework.","license":"other","stars":5499,"archived":false,"last_commit":"2024-05-01T16:29:33Z","days_since_commit":901,"release":{"tag":"v3.2.3","date":"2024-05-07T12:53:36Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":28135622,"owner_id":9535064,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":46860630,"repo":"abusesa/abusehelper","listed_as":"abusesa/abusehelper","name":"AbuseHelper","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"A framework for receiving and redistributing abuse feeds","license":"MIT","stars":125,"archived":false,"last_commit":"2019-09-27T12:17:27Z","days_since_commit":2579,"release":{"tag":"v5.7.0","date":"2019-02-12T11:56:56Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":46860630,"owner_id":15380546,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":24228422,"repo":"csirtgadgets/bearded-avenger","listed_as":"csirtgadgets/bearded-avenger","name":"Bearded Avenger","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"CIF v3 -- the fastest way to consume threat intelligence","license":"MPL-2.0","stars":189,"archived":true,"last_commit":"2023-04-20T22:54:05Z","days_since_commit":1277,"release":{"tag":"3.1.0","date":"2021-03-10T01:45:27Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":24228422,"owner_id":5203786,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":78524793,"repo":"TheHive-Project/Cortex","listed_as":"TheHive-Project/Cortex","name":"Cortex","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"Cortex: a Powerful Observable Analysis and Active Response Engine","license":"AGPL-3.0","stars":1632,"archived":false,"last_commit":"2026-10-13T14:22:05Z","days_since_commit":6,"release":{"tag":"4.1.0","date":"2026-06-30T09:01:11Z","assets":0,"verification":null},"weeks":[1,0,0,1,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,0,1,2,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":78524793,"owner_id":22081224,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":231109256,"repo":"intelowlproject/IntelOwl","listed_as":"intelowlproject/IntelOwl","name":"IntelOwl","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"IntelOwl: manage your Threat Intelligence at scale","license":"AGPL-3.0","stars":4765,"archived":false,"last_commit":"2026-09-02T04:33:26Z","days_since_commit":47,"release":{"tag":"v6.8.0","date":"2026-08-31T18:53:50Z","assets":0,"verification":null},"weeks":[11,5,3,2,1,2,1,6,0,18,1,11,2,21,17,8,7,10,6,9,7,13,25,3,2,6,0,0,1,0,8,2,16,8,4,20,2,0,1,0,7,12,1,0,6,0,0,0,0,0,0,0],"advisories":[{"id":"GHSA-cjrq-vmxr-6h86","cve":"","severity":"low","published":"2024-03-28","summary":"Using Local Storage to Store Session Token"},{"id":"GHSA-h5hc-9w84-cf4m","cve":"","severity":"low","published":"2023-01-17","summary":"User enumeration vulnerability on invite feature"}],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":231109256,"owner_id":65157868,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":33385419,"repo":"opensourcesec/malstrom","listed_as":"byt3smith/malstrom","name":"Malstrom","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"Cyber Intel Management","license":"MIT","stars":50,"archived":true,"last_commit":"2018-01-25T18:19:34Z","days_since_commit":3189,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"renamed","from":"byt3smith/malstrom","to":"opensourcesec/malstrom"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":33385419,"owner_id":26194022,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":103104354,"repo":"stratosphereips/Manati","listed_as":"stratosphereips/Manati","name":"ManaTI","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"A web-based tool to assist the work of the intuitive threat analysts.","license":"","stars":114,"archived":false,"last_commit":"2019-01-04T16:27:51Z","days_since_commit":2845,"release":{"tag":"v0.12.2a","date":"2018-11-11T19:50:28Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":103104354,"owner_id":10548938,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":11197377,"repo":"cert-se/megatron-java","listed_as":"cert-se/megatron-java","name":"Megatron","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"Megatron - A System for Abuse- and Incident Handling","license":"Apache-2.0","stars":45,"archived":false,"last_commit":"2017-03-29T10:39:30Z","days_since_commit":3491,"release":{"tag":"v.1.1.1","date":"2017-03-29T11:32:59Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":11197377,"owner_id":4940460,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":138332861,"repo":"CERT-Polska/n6","listed_as":"CERT-Polska/n6","name":"n6","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"Automated handling of data feeds for security teams","license":"AGPL-3.0","stars":149,"archived":false,"last_commit":"2026-06-04T11:22:17Z","days_since_commit":137,"release":{"tag":"v4.42.0","date":"2026-06-03T16:52:00Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":138332861,"owner_id":1210616,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":27070258,"repo":"eclecticiq/OpenTAXII","listed_as":"EclecticIQ/OpenTAXII","name":"OpenTAXII","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"TAXII server implementation in Python from EclecticIQ","license":"BSD-3-Clause","stars":217,"archived":false,"last_commit":"2026-01-05T15:14:52Z","days_since_commit":287,"release":{"tag":"0.10.0b1","date":"2026-01-05T15:15:31Z","assets":2,"verification":"none"},"weeks":[0,0,23,0,0,33,43,8,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":27070258,"owner_id":8667254,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":61313276,"repo":"Ptr32Void/OSTrICa","listed_as":"Ptr32Void/OSTrICa","name":"OSTrICa","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"","license":"","stars":302,"archived":false,"last_commit":"2017-05-28T15:59:29Z","days_since_commit":3431,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":61313276,"owner_id":7305357,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":null,"repo":"Lookingglass/opentpx","listed_as":"Lookingglass/opentpx","name":"Open Threat Partner eXchange","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"","license":"","stars":0,"archived":false,"last_commit":null,"days_since_commit":null,"release":null,"weeks":null,"advisories":null,"status":"unavailable","signals":[],"checked":"2026-10-19T22:22:17Z","history":[{"date":"2026-10-19","type":"first_seen","status":"unavailable"}]},{"id":22670215,"repo":"Netflix-Skunkworks/Scumblr","listed_as":"Netflix/Scumblr","name":"Scumblr","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"Web framework that allows performing periodic syncs of data sources and performing analysis on the identified results","license":"Apache-2.0","stars":2638,"archived":false,"last_commit":"2019-02-05T15:55:37Z","days_since_commit":2813,"release":{"tag":"2.1.0","date":"2017-09-25T23:09:38Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"Netflix/Scumblr","to":"Netflix-Skunkworks/Scumblr"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":22670215,"owner_id":1728142,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":40135809,"repo":"Tripwire/TARDIS","listed_as":"tripwire/tardis","name":"TARDIS","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"Threat Analysis, Reconnaissance, and Data Intelligence System","license":"Apache-2.0","stars":125,"archived":false,"last_commit":"2015-08-28T23:30:34Z","days_since_commit":4069,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":40135809,"owner_id":4419286,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":435954538,"repo":"typedb-osi/typedb-cti","listed_as":"typedb-osi/typedb-cti","name":"TypeDB CTI","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"Open Source Threat Intelligence Platform","license":"","stars":170,"archived":false,"last_commit":"2026-01-08T11:00:17Z","days_since_commit":284,"release":null,"weeks":[6,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":435954538,"owner_id":83308567,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":null,"repo":"brianwarehime/threatnote","listed_as":"brianwarehime/threatnote","name":"threatnote.io","category":"threat-intelligence","subcategory":"Frameworks and Platforms","source":"awesome-threat-intelligence","description":"","license":"","stars":0,"archived":false,"last_commit":null,"days_since_commit":null,"release":null,"weeks":null,"advisories":null,"status":"unavailable","signals":[],"checked":"2026-10-19T22:22:17Z","history":[{"date":"2026-10-19","type":"first_seen","status":"unavailable"}]},{"id":94886282,"repo":"jalewis/actortrackr","listed_as":"jalewis/actortrackr","name":"ActorTrackr","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Home to the ActorTrackr source code","license":"other","stars":31,"archived":false,"last_commit":"2017-08-31T12:29:21Z","days_since_commit":3336,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"fork"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":94886282,"owner_id":385983,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":756222208,"repo":"referefref/aiocrioc","listed_as":"referefref/aiocrioc","name":"AIOCRIOC","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"An LLM and OCR based Indicator of Compromise Extraction Tool","license":"Apache-2.0","stars":38,"archived":false,"last_commit":"2024-12-04T14:31:42Z","days_since_commit":684,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":756222208,"owner_id":56499429,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":14321138,"repo":"1aN0rmus/TekDefense-Automater","listed_as":"1aN0rmus/TekDefense-Automater","name":"Automater","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Automater - IP URL and MD5 OSINT Analysis","license":"MIT","stars":557,"archived":false,"last_commit":"2016-05-30T22:54:57Z","days_since_commit":3793,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":14321138,"owner_id":2610310,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":377838860,"repo":"svdwi/BlueBox","listed_as":"svdwi/BlueBox","name":"BlueBox","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"BlueBox Malware analysis Box and Cyber threat intelligence.","license":"","stars":50,"archived":false,"last_commit":"2022-04-17T00:34:38Z","days_since_commit":1646,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":377838860,"owner_id":61978917,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":28566472,"repo":"exp0se/bro-intel-generator","listed_as":"exp0se/bro-intel-generator","name":"bro-intel-generator","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Script for generating Bro intel files from pdf or html reports","license":"MIT","stars":76,"archived":true,"last_commit":"2015-12-07T10:25:57Z","days_since_commit":3969,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":28566472,"owner_id":7989216,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":27764997,"repo":"eclecticiq/cabby","listed_as":"EclecticIQ/cabby","name":"cabby","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"TAXII client implementation from EclecticIQ","license":"other","stars":105,"archived":false,"last_commit":"2021-09-03T18:56:17Z","days_since_commit":1872,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":27764997,"owner_id":8667254,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":50754264,"repo":"sroberts/cacador","listed_as":"sroberts/cacador","name":"cacador","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Indicator Extractor","license":"MIT","stars":141,"archived":false,"last_commit":"2018-07-14T12:35:03Z","days_since_commit":3019,"release":{"tag":"v0.0.1","date":"2016-04-03T03:33:25Z","assets":7,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":50754264,"owner_id":44774,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":17064089,"repo":"mlsecproject/combine","listed_as":"mlsecproject/combine","name":"Combine","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Tool to gather Threat Intelligence indicators from publicly available sources","license":"GPL-3.0","stars":654,"archived":false,"last_commit":"2016-07-26T18:26:11Z","days_since_commit":3737,"release":{"tag":"v0.1.3","date":"2015-04-27T02:34:11Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":17064089,"owner_id":6607461,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":15086898,"repo":"CrowdStrike/CrowdFMS","listed_as":"CrowdStrike/CrowdFMS","name":"CrowdFMS","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"CrowdStrike Feed Management System. CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system. This framework automatically downloads recent samples, which triggered an alert on the users YARA notification feed.","license":"BSD-2-Clause","stars":133,"archived":true,"last_commit":"2014-02-13T15:03:52Z","days_since_commit":4631,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":15086898,"owner_id":2446477,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":99188653,"repo":"cylance/CyBot","listed_as":"CylanceSPEAR/CyBot","name":"CyBot","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Open Source Threat Intelligence Chat Bot","license":"","stars":317,"archived":false,"last_commit":"2019-09-17T18:31:09Z","days_since_commit":2589,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"CylanceSPEAR/CyBot","to":"cylance/CyBot"},{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":99188653,"owner_id":2954975,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":43861569,"repo":"Neo23x0/Fenrir","listed_as":"Neo23x0/Fenrir","name":"Fenrir","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Simple Bash IOC Scanner","license":"MIT","stars":778,"archived":false,"last_commit":"2022-02-12T09:33:35Z","days_since_commit":1710,"release":{"tag":"v0.9.0","date":"2021-12-13T12:22:05Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":43861569,"owner_id":2851492,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":105667433,"repo":"spacepatcher/firehol-ip-aggregator","listed_as":"spacepatcher/FireHOL-IP-Aggregator","name":"FireHOL IP Aggregator","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"App for storing FireHOL feeds (https://github.com/firehol/blocklist-ipsets) with a history of adding and removing each address","license":"Apache-2.0","stars":35,"archived":false,"last_commit":"2023-01-04T13:31:23Z","days_since_commit":1384,"release":{"tag":"v2.0.1","date":"2019-02-02T19:52:57Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":105667433,"owner_id":16436574,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":17264589,"repo":"opensourcesec/Forager","listed_as":"byt3smith/Forager","name":"Forager","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Multithreaded threat Intelligence gathering built with Python3","license":"MIT","stars":178,"archived":false,"last_commit":"2018-01-23T17:50:22Z","days_since_commit":3191,"release":{"tag":"v2.0.3","date":"2016-04-12T18:09:03Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"byt3smith/Forager","to":"opensourcesec/Forager"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":17264589,"owner_id":26194022,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":50126380,"repo":"BinaryDefense/goatrider","listed_as":"BinaryDefense/goatrider","name":"GoatRider","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"GoatRider is a simple tool that will dynamically pull down Artillery Threat Intelligence Feeds, TOR, AlienVaults OTX, and the Alexa top 1 million websites and do a comparison to a hostname file or IP file. ","license":"other","stars":145,"archived":false,"last_commit":"2018-11-20T21:17:30Z","days_since_commit":2890,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":50126380,"owner_id":10130449,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":99263762,"repo":"ciscocsirt/GOSINT","listed_as":"ciscocsirt/gosint","name":"GOSINT","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"The GOSINT framework is a project used for collecting, processing, and exporting high quality indicators of compromise (IOCs).","license":"BSD-3-Clause","stars":561,"archived":true,"last_commit":"2023-05-09T22:51:23Z","days_since_commit":1258,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":99263762,"owner_id":19170330,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":46175022,"repo":"exp0se/harbinger","listed_as":"exp0se/harbinger","name":"Harbinger Threat Intelligence","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Harbinger Threat Intelligence","license":"","stars":82,"archived":true,"last_commit":"2015-12-08T14:45:52Z","days_since_commit":3968,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":46175022,"owner_id":7989216,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":72828565,"repo":"TheHive-Project/Hippocampe","listed_as":"TheHive-Project/Hippocampe","name":"Hippocampe","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Threat Feed Aggregation, Made Easy","license":"AGPL-3.0","stars":169,"archived":true,"last_commit":"2018-10-19T13:14:51Z","days_since_commit":2922,"release":{"tag":"1.0.0","date":"2017-01-18T14:15:38Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":72828565,"owner_id":22081224,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":38191136,"repo":"S03D4-164/Hiryu","listed_as":"S03D4-164/Hiryu","name":"Hiryu","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"IOC Management and Visualization Tool","license":"","stars":48,"archived":false,"last_commit":"2018-09-01T05:32:16Z","days_since_commit":2970,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":38191136,"owner_id":12199393,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":118902054,"repo":"fhightower/ioc-finder","listed_as":"fhightower/ioc-finder","name":"IOC Finder","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/","license":"LGPL-3.0","stars":184,"archived":false,"last_commit":"2026-10-18T14:30:24Z","days_since_commit":1,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,3,3,7,2,1,7,9,15,4,6,0,9,10,3,7,3,3,3,2,8,3,2,2,2,3,2,2,1,2,0,2,1,1],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":118902054,"owner_id":3599813,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":106330968,"repo":"ioc-fang/ioc-fanger","listed_as":"ioc-fang/ioc_fanger","name":"IOC Fanger (and Defanger)","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .","license":"MIT","stars":68,"archived":false,"last_commit":"2026-10-18T14:32:52Z","days_since_commit":1,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,6,0,2,6,7,6,3,1,3,3,3,3,2,2,2,3,2,2,2,1,3,2,0,2],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"ioc-fang/ioc_fanger","to":"ioc-fang/ioc-fanger"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":106330968,"owner_id":32465003,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":30123001,"repo":"armbues/ioc_parser","listed_as":"armbues/ioc_parser","name":"iocparser","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Tool to extract indicators of compromise from security reports in PDF format","license":"MIT","stars":439,"archived":false,"last_commit":"2017-06-15T08:09:03Z","days_since_commit":3413,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":30123001,"owner_id":4117144,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":11642168,"repo":"mandiant/ioc_writer","listed_as":"mandiant/ioc_writer","name":"iocwriter","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"","license":"Apache-2.0","stars":208,"archived":true,"last_commit":"2017-12-11T17:13:12Z","days_since_commit":3234,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":11642168,"owner_id":331209,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":129942209,"repo":"pedramamini/iocextract","listed_as":"InQuest/python-iocextract","name":"iocextract","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Defanged Indicator of Compromise (IOC) Extractor.","license":"GPL-2.0","stars":584,"archived":false,"last_commit":"2024-08-28T16:04:18Z","days_since_commit":782,"release":{"tag":"v1.16.1","date":"2023-09-22T18:11:57Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"InQuest/python-iocextract","to":"pedramamini/iocextract"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":129942209,"owner_id":1253573,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":4929874,"repo":"stephenbrannon/IOCextractor","listed_as":"stephenbrannon/IOCextractor","name":"IOCextractor","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"IOC (Indicator of Compromise) Extractor: a program to help extract IOCs from text files. ","license":"","stars":135,"archived":false,"last_commit":"2013-09-24T18:50:10Z","days_since_commit":4773,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":4929874,"owner_id":1743668,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":38064846,"repo":"johestephan/ibmxforceex.checker.py","listed_as":"johestephan/ibmxforceex.checker.py","name":"ibmxforceex.checker.py","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Python based client for IBM XForce Exchange","license":"Apache-2.0","stars":26,"archived":true,"last_commit":"2016-08-05T12:03:34Z","days_since_commit":3727,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":38064846,"owner_id":7138386,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":19941850,"repo":"sroberts/jager","listed_as":"sroberts/jager","name":"jager","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Hunting IOCs all day every day...","license":"other","stars":89,"archived":false,"last_commit":"2021-05-18T22:54:57Z","days_since_commit":1979,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":19941850,"owner_id":44774,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":null,"repo":"KasperskyLab/klara","listed_as":"KasperskyLab/klara","name":"KLara","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"","license":"","stars":0,"archived":false,"last_commit":null,"days_since_commit":null,"release":null,"weeks":null,"advisories":null,"status":"unavailable","signals":[],"checked":"2026-10-19T22:22:17Z","history":[{"date":"2026-10-19","type":"first_seen","status":"unavailable"}]},{"id":9648328,"repo":"TAXIIProject/libtaxii","listed_as":"TAXIIProject/libtaxii","name":"libtaxii","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"A Python library for handling TAXII Messages invoking TAXII Services.","license":"BSD-3-Clause","stars":74,"archived":false,"last_commit":"2021-04-20T21:10:09Z","days_since_commit":2008,"release":{"tag":"1.1.119","date":"2021-04-15T17:27:24Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":9648328,"owner_id":2953067,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":38626980,"repo":"HurricaneLabs/machinae","listed_as":"HurricaneLabs/machinae","name":"Machinae","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Machinae Security Intelligence Collector","license":"MIT","stars":536,"archived":false,"last_commit":"2026-06-03T16:43:04Z","days_since_commit":138,"release":{"tag":"1.4.8","date":"2019-05-09T12:46:23Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":38626980,"owner_id":4613806,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":128127537,"repo":"silascutler/MalPipe","listed_as":"silascutler/MalPipe","name":"MalPipe","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Malware/IOC ingestion and processing engine","license":"GPL-3.0","stars":110,"archived":false,"last_commit":"2018-11-20T16:36:10Z","days_since_commit":2890,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":128127537,"owner_id":2154372,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":480690223,"repo":"MISP/misp-workbench","listed_as":"MISP/misp-workbench","name":"MISP Workbench","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Built for the frontlines of cyber defense, our next-generation MISP empowers edge deployments and threat hunters with fast, lightweight, and actionable intelligence, anytime, anywhere.","license":"AGPL-3.0","stars":35,"archived":false,"last_commit":"2026-10-15T14:41:08Z","days_since_commit":4,"release":{"tag":"beta-1.6","date":"2026-07-09T12:44:30Z","assets":0,"verification":null},"weeks":[0,0,2,1,0,0,0,17,1,0,11,8,14,6,32,53,42,53,51,35,40,26,77,24,41,24,12,50,19,24,1,15,14,1,0,0,13,1,2,1,0,0,0,18,17,1,33,0,8,53,76,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":480690223,"owner_id":4134875,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":74113304,"repo":"MISP/MISP-Taxii-Server","listed_as":"MISP/MISP-Taxii-Server","name":"MISP-Taxii-Server","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"An OpenTAXII Configuration for MISP","license":"BSD-3-Clause","stars":88,"archived":false,"last_commit":"2022-06-14T07:44:27Z","days_since_commit":1588,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":74113304,"owner_id":4134875,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":171915396,"repo":"microsoft/msticpy","listed_as":"microsoft/msticpy","name":"MSTIC Jupyter and Python Security Tools","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Microsoft Threat Intelligence Security Tools","license":"other","stars":2018,"archived":false,"last_commit":"2026-10-15T15:32:16Z","days_since_commit":4,"release":{"tag":"v3.1.0","date":"2026-09-21T22:52:42Z","assets":0,"verification":null},"weeks":[2,1,0,0,0,0,2,3,0,0,3,9,21,1,9,27,0,0,0,0,7,3,0,0,0,0,23,5,6,0,0,5,0,0,0,0,0,7,0,1,7,4,1,0,1,0,4,11,6,1,4,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":171915396,"owner_id":6154722,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":27328980,"repo":"paulpc/nyx","listed_as":"paulpc/nyx","name":"nyx","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Threat Intelligence distribution","license":"MIT","stars":31,"archived":false,"last_commit":"2015-12-30T22:31:18Z","days_since_commit":3945,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":27328980,"owner_id":283592,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":87248134,"repo":"fhightower/onemillion","listed_as":"fhightower/onemillion","name":"OneMillion","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Determine if a domain is in the Alexa or Cisco top one million domain list.","license":"MIT","stars":9,"archived":false,"last_commit":"2022-10-19T12:21:15Z","days_since_commit":1461,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":87248134,"owner_id":3599813,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":14406485,"repo":"STIXProject/openioc-to-stix","listed_as":"STIXProject/openioc-to-stix","name":"openioc-to-stix","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Generate STIX XML from OpenIOC XML","license":"BSD-3-Clause","stars":97,"archived":false,"last_commit":"2018-10-18T12:27:36Z","days_since_commit":2923,"release":{"tag":"v1.4.0","date":"2018-10-17T15:04:17Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":14406485,"owner_id":2774079,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":109027464,"repo":"InQuest/omnibus","listed_as":"InQuest/omnibus","name":"Omnibus","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"The OSINT Omnibus (beta release)","license":"MIT","stars":358,"archived":false,"last_commit":"2019-11-07T16:36:10Z","days_since_commit":2538,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":109027464,"owner_id":5151505,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":4036545,"repo":"mgeide/poortego","listed_as":"mgeide/poortego","name":"poortego","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Open-source python project to handle the storage and linking of open-source intelligence (ala Maltego)","license":"MIT","stars":122,"archived":false,"last_commit":"2018-04-11T18:09:17Z","days_since_commit":3113,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":4036545,"owner_id":1646562,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":22967752,"repo":"YahooArchive/PyIOCe","listed_as":"yahoo/PyIOCe","name":"PyIOCe","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Python IOC Editor","license":"Apache-2.0","stars":66,"archived":true,"last_commit":"2015-03-10T03:58:30Z","days_since_commit":4241,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"renamed","from":"yahoo/PyIOCe","to":"YahooArchive/PyIOCe"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":22967752,"owner_id":19540805,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":53153004,"repo":"QTek/QRadio","listed_as":"QTek/QRadio","name":"QRadio","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"QRadio ~ Best Threat Intelligence Radio ~ Tune In! ","license":"Apache-2.0","stars":101,"archived":false,"last_commit":"2016-05-20T16:10:45Z","days_since_commit":3804,"release":{"tag":"v1.4.0","date":"2016-03-09T01:26:13Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":53153004,"owner_id":17649255,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":30250643,"repo":"aboutsecurity/rastrea2r","listed_as":"aboutsecurity/rastrea2r","name":"rastrea2r","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Collecting & Hunting for IOCs with gusto and style","license":"","stars":118,"archived":false,"last_commit":"2018-08-09T16:26:08Z","days_since_commit":2993,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":30250643,"owner_id":773618,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":69111161,"repo":"activecm/rita-legacy","listed_as":"ocmdev/rita","name":"RITA","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.","license":"GPL-3.0","stars":2512,"archived":false,"last_commit":"2026-01-12T22:56:41Z","days_since_commit":279,"release":{"tag":"v4.8.2","date":"2026-01-12T23:00:09Z","assets":2,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"renamed","from":"ocmdev/rita","to":"activecm/rita-legacy"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":69111161,"owner_id":22244274,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":163263462,"repo":"spacepatcher/softrace","listed_as":"spacepatcher/softrace","name":"Softrace","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Lightweight and fast NSRL RDS storage","license":"Apache-2.0","stars":4,"archived":false,"last_commit":"2021-03-30T19:18:25Z","days_since_commit":2029,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":163263462,"owner_id":16436574,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":null,"repo":"0x4d31/sqhunter","listed_as":"0x4d31/sqhunter","name":"sqhunter","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"","license":"","stars":0,"archived":false,"last_commit":null,"days_since_commit":null,"release":null,"weeks":null,"advisories":null,"status":"unavailable","signals":[],"checked":"2026-10-19T22:22:17Z","history":[{"date":"2026-10-19","type":"first_seen","status":"unavailable"}]},{"id":133270820,"repo":"SecurityRiskAdvisors/sra-taxii2-server","listed_as":"SecurityRiskAdvisors/sra-taxii2-server","name":"SRA TAXII2 Server","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"TAXII 2.0 Server implemented in Node JS with MongoDB backend","license":"MIT","stars":12,"archived":true,"last_commit":"2019-08-28T22:12:47Z","days_since_commit":2609,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":133270820,"owner_id":16674252,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":177214845,"repo":"traut/stixview","listed_as":"traut/stixview","name":"Stixview","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"STIX2 graph visualisation library in JS","license":"BSD-3-Clause","stars":102,"archived":false,"last_commit":"2025-06-21T19:53:11Z","days_since_commit":485,"release":{"tag":"v2.2.0","date":"2024-07-14T12:56:45Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":177214845,"owner_id":45051,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":14027958,"repo":"STIXProject/stix-viz","listed_as":"STIXProject/stix-viz","name":"stix-viz","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"STIX Visualization Tool","license":"BSD-3-Clause","stars":111,"archived":false,"last_commit":"2016-09-21T23:45:57Z","days_since_commit":3679,"release":{"tag":"v1.0.7a","date":"2018-07-13T13:22:13Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":14027958,"owner_id":2774079,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":null,"repo":"jpsenior/threataggregator","listed_as":"jpsenior/threataggregator","name":"threataggregator","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"","license":"","stars":0,"archived":false,"last_commit":null,"days_since_commit":null,"release":null,"weeks":null,"advisories":null,"status":"unavailable","signals":[],"checked":"2026-10-19T22:22:17Z","history":[{"date":"2026-10-19","type":"first_seen","status":"unavailable"}]},{"id":51741298,"repo":"jheise/threatcrowd_api","listed_as":"jheise/threatcrowd_api","name":"threatcrowdapi","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Python wrapper for threatcrowd's api","license":"MIT","stars":10,"archived":false,"last_commit":"2017-07-06T23:34:58Z","days_since_commit":3391,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":51741298,"owner_id":811223,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":52859368,"repo":"jheise/threatcmd","listed_as":"jheise/threatcmd","name":"threatcmd","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Cli interface to threatcrowd.org","license":"MIT","stars":21,"archived":false,"last_commit":"2017-07-06T23:39:10Z","days_since_commit":3391,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":52859368,"owner_id":811223,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":20443662,"repo":"syphon1c/Threatelligence","listed_as":"syphon1c/Threatelligence","name":"Threatelligence","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Threatelligence is a simple cyber threat intelligence feed collector, using Elasticsearch, Kibana and Python to automatically collect intelligence from custom or public sources. Automatically updates feeds and tries to further enhance data for dashboards.","license":"","stars":152,"archived":true,"last_commit":"2014-06-03T15:13:36Z","days_since_commit":4521,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":20443662,"owner_id":1331997,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":102033255,"repo":"pedramamini/ThreatIngestor","listed_as":"InQuest/ThreatIngestor","name":"ThreatIngestor","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Extract and aggregate threat intelligence.","license":"GPL-2.0","stars":932,"archived":false,"last_commit":"2026-05-26T15:01:23Z","days_since_commit":146,"release":{"tag":"v1.4.0","date":"2023-11-02T16:16:26Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[{"type":"renamed","from":"InQuest/ThreatIngestor","to":"pedramamini/ThreatIngestor"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":102033255,"owner_id":1253573,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":31884275,"repo":"michael-yip/ThreatTracker","listed_as":"michael-yip/ThreatTracker","name":"ThreatTracker","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"ThreatTracker is a Python script designed to monitor and generate alerts on given sets of indicators of compromise (IOCs) indexed by a set of Google Custom Search Engines.","license":"","stars":71,"archived":false,"last_commit":"2015-03-09T22:30:59Z","days_since_commit":4241,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":31884275,"owner_id":7409312,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":30200955,"repo":"Yelp/threat_intel","listed_as":"Yelp/threat_intel","name":"threatintel","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Threat Intelligence APIs","license":"MIT","stars":286,"archived":false,"last_commit":"2026-05-05T16:47:48Z","days_since_commit":167,"release":{"tag":"v0.2.0","date":"2020-04-23T10:09:51Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":30200955,"owner_id":49071,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":41807769,"repo":"abhinavbom/Threat-Intelligence-Hunter","listed_as":"abhinavbom/Threat-Intelligence-Hunter","name":"Threat-Intelligence-Hunter","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"TIH is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well known APIs. The idea behind the tool is to facilitate searching and storing of frequently added IOCs for creating your own local database of indicators.","license":"MIT","stars":157,"archived":false,"last_commit":"2018-07-09T20:13:01Z","days_since_commit":3024,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":41807769,"owner_id":232763,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":18271023,"repo":"mlsecproject/tiq-test","listed_as":"mlsecproject/tiq-test","name":"tiq-test","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"Threat Intelligence Quotient Test - Dataviz and Statistical Analysis of TI feeds","license":"GPL-3.0","stars":179,"archived":false,"last_commit":"2015-10-19T03:32:25Z","days_since_commit":4018,"release":{"tag":"v0.2.0","date":"2015-02-01T21:24:14Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":18271023,"owner_id":6607461,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":10743711,"repo":"TAXIIProject/yeti","listed_as":"TAXIIProject/yeti","name":"YETI","category":"threat-intelligence","subcategory":"Tools","source":"awesome-threat-intelligence","description":"YETI is a TAXII implementation","license":"BSD-3-Clause","stars":47,"archived":true,"last_commit":"2019-05-10T20:06:57Z","days_since_commit":2719,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":10743711,"owner_id":2953067,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":21290287,"repo":"Netflix/security_monkey","listed_as":"Netflix/security_monkey","name":"Security Monkey","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.","license":"Apache-2.0","stars":4371,"archived":true,"last_commit":"2021-02-11T02:32:12Z","days_since_commit":2076,"release":{"tag":"1.1.3","date":"2018-05-24T22:36:12Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":21290287,"owner_id":913567,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":125542646,"repo":"sendgrid/krampus","listed_as":"sendgrid/krampus","name":"Krampus","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"The original AWS security enforcer™","license":"MIT","stars":62,"archived":false,"last_commit":"2019-03-06T03:31:41Z","days_since_commit":2784,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":125542646,"owner_id":181234,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":111150198,"repo":"RiotGames/cloud-inquisitor","listed_as":"RiotGames/cloud-inquisitor","name":"Cloud Inquisitor","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"Enforce ownership and data security within AWS","license":"Apache-2.0","stars":445,"archived":true,"last_commit":"2020-04-16T17:01:01Z","days_since_commit":2377,"release":{"tag":"2.2.0","date":"2018-09-24T21:26:18Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":111150198,"owner_id":910843,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":58080701,"repo":"te-papa/aws-key-disabler","listed_as":"te-papa/aws-key-disabler","name":"Disable keys after X days","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"A small lambda script that will disable access keys older than a given amount of days.","license":"ISC","stars":154,"archived":false,"last_commit":"2021-07-05T23:31:30Z","days_since_commit":1931,"release":{"tag":"1.1.2","date":"2018-03-14T20:54:04Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":58080701,"owner_id":5342454,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":92442522,"repo":"Netflix/repokid","listed_as":"Netflix/repokid","name":"Repokid Least Privilege","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"AWS Least Privilege for Distributed, High-Velocity Deployment","license":"Apache-2.0","stars":1146,"archived":false,"last_commit":"2021-08-25T20:14:58Z","days_since_commit":1881,"release":{"tag":"v0.19.8","date":"2021-08-25T20:22:39Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":92442522,"owner_id":913567,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":141596594,"repo":"dowjones/hammer","listed_as":"dowjones/hammer","name":"Hammer","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"Dow Jones Hammer : Protect the cloud with the power of the cloud(AWS)","license":"other","stars":450,"archived":false,"last_commit":"2019-06-26T16:23:13Z","days_since_commit":2672,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":141596594,"owner_id":4172353,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":121765548,"repo":"btkrausen/aws","listed_as":"btkrausen/AWS","name":"Billing Alerts CFN templates","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"","license":"MIT","stars":75,"archived":false,"last_commit":"2023-08-06T17:30:58Z","days_since_commit":1170,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":121765548,"owner_id":30417793,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":110502518,"repo":"iagcl/watchmen","listed_as":"iagcl/watchmen","name":"Watchmen","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"(Not maintained anymore) Watchmen - AWS account compliance using centrally managed Config Rules","license":"Apache-2.0","stars":176,"archived":false,"last_commit":"2018-09-05T02:48:23Z","days_since_commit":2966,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":110502518,"owner_id":22605384,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":238931093,"repo":"jonrau1/ElectricEye","listed_as":"jonrau1/ElectricEye","name":"ElectricEye","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks","license":"Apache-2.0","stars":1049,"archived":false,"last_commit":"2025-09-02T15:19:09Z","days_since_commit":412,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":238931093,"owner_id":46727149,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":257634474,"repo":"jonrau1/SyntheticSun","listed_as":"jonrau1/SyntheticSun","name":"SyntheticSun","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.","license":"GPL-3.0","stars":82,"archived":false,"last_commit":"2021-07-08T02:10:11Z","days_since_commit":1929,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":257634474,"owner_id":46727149,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":313853293,"repo":"cloudquery/cloudquery","listed_as":"cloudquery/cloudquery","name":"CloudQuery","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.","license":"MPL-2.0","stars":6544,"archived":false,"last_commit":"2026-10-19T14:40:56Z","days_since_commit":0,"release":{"tag":"cli-v6.49.0","date":"2026-10-19T13:20:20Z","assets":11,"verification":"checksum"},"weeks":[12,44,41,20,7,16,16,48,12,21,35,43,4,18,82,36,14,48,85,19,79,65,98,20,102,97,74,13,12,8,7,72,23,16,11,57,60,13,33,30,35,19,14,14,53,3,4,42,50,84,19,9],"advisories":[],"status":"active","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":313853293,"owner_id":74616112,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":298120521,"repo":"omaiddotsh/PrismX","listed_as":"omaidf/PrismX","name":"PrismX","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"Cloud Security Dashboard for AWS - based on ScoutSuite","license":"GPL-2.0","stars":1,"archived":false,"last_commit":"2020-10-09T16:47:29Z","days_since_commit":2201,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"renamed","from":"omaidf/PrismX","to":"omaiddotsh/PrismX"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":298120521,"owner_id":11565994,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":49986046,"repo":"falcosecurity/falco","listed_as":"falcosecurity/falco","name":"Falco","category":"cloud-security","subcategory":"Continuous Security Auditing","source":"my-arsenal-of-aws-security-tools","description":"Cloud Native Runtime Security","license":"Apache-2.0","stars":9499,"archived":false,"last_commit":"2026-10-19T07:55:45Z","days_since_commit":0,"release":{"tag":"0.45.1","date":"2026-10-19T10:49:56Z","assets":2,"verification":"none"},"weeks":[2,3,1,7,7,1,4,3,3,1,20,6,14,2,3,3,9,3,3,9,3,3,3,8,14,5,3,5,10,19,2,1,5,2,0,8,2,7,5,3,1,0,2,1,4,22,12,3,6,2,5,1],"advisories":[{"id":"GHSA-7cq5-h4p2-h37p","cve":"","severity":"low","published":"2025-04-30","summary":"Unsupported detection of asynchronous io_uring operations"},{"id":"GHSA-6v9j-2vm2-ghf7","cve":"CVE-2022-26316","severity":"medium","published":"2022-03-11","summary":"TOCTOU issue that could lead to rule bypass"},{"id":"GHSA-c7mr-v692-9p4g","cve":"","severity":"critical","published":"2021-05-07","summary":"Undetected crash of the kernel module disables Falco"},{"id":"GHSA-rfgw-vmxp-hp5g","cve":"","severity":"high","published":"2021-05-07","summary":" Default rules can be bypassed with different techniques"},{"id":"GHSA-qfjf-hpq4-6m37","cve":"","severity":"low","published":"2021-05-07","summary":"Security flags not enforced my CMake-files"},{"id":"GHSA-cxrc-f2j2-3rj3","cve":"","severity":"low","published":"2021-04-19","summary":"Dependencies pulled via hard-coded HTTP links"},{"id":"GHSA-wr4f-m7x5-g6x7","cve":"","severity":"high","published":"2021-04-19","summary":"HTTP request with incorrect data leads to crashes"},{"id":"GHSA-q77j-vxxw-mwgj","cve":"","severity":"high","published":"2021-04-19","summary":"Concurrent requests towards Lua state can lead to crashes"}],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":49986046,"owner_id":42391047,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":63271084,"repo":"ThreatResponse/aws_ir","listed_as":"ThreatResponse/aws_ir","name":"AWS IR","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Python installable command line utiltity for mitigation of host and key compromises. ","license":"MIT","stars":342,"archived":false,"last_commit":"2021-07-14T20:46:44Z","days_since_commit":1923,"release":{"tag":"v0.3.2","date":"2018-07-08T20:32:09Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":63271084,"owner_id":19498742,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":131768423,"repo":"Netflix-Skunkworks/diffy","listed_as":"Netflix-Skunkworks/diffy","name":"Diffy","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":":no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.","license":"Apache-2.0","stars":630,"archived":false,"last_commit":"2023-07-25T17:52:28Z","days_since_commit":1182,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":131768423,"owner_id":1728142,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":53611430,"repo":"awslabs/aws-security-automation","listed_as":"awslabs/aws-security-automation","name":"AWS Security Automation","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Collection of scripts and resources for DevSecOps and Automated Incident Response Security","license":"","stars":632,"archived":true,"last_commit":"2026-01-14T23:30:04Z","days_since_commit":277,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":53611430,"owner_id":3299148,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":145217601,"repo":"ansorren/GDPatrol","listed_as":"ansorren/GDPatrol","name":"GDPatrol","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"A Lambda-powered Security Orchestration framework for AWS GuardDuty","license":"MIT","stars":53,"archived":true,"last_commit":"2019-12-15T18:42:58Z","days_since_commit":2500,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":145217601,"owner_id":25956692,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":148192829,"repo":"jaksi/awslog","listed_as":"jaksi/awslog","name":"AWSlog","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Show the history and changes between configuration versions of AWS resources","license":"MIT","stars":70,"archived":true,"last_commit":"2019-03-22T15:06:26Z","days_since_commit":2768,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":148192829,"owner_id":479446,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":502700685,"repo":"damienjburks/DataCop","listed_as":"damienjburks/DataCop","name":"DataCop","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Protect your data in AWS S3 with DataCop!","license":"Apache-2.0","stars":14,"archived":false,"last_commit":"2024-04-23T01:38:43Z","days_since_commit":909,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":502700685,"owner_id":20100558,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":null,"repo":"prolsen/aws_responder","listed_as":"prolsen/aws_responder","name":"AWSResponder","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"","license":"","stars":0,"archived":false,"last_commit":null,"days_since_commit":null,"release":null,"weeks":null,"advisories":null,"status":"unavailable","signals":[],"checked":"2026-10-19T22:22:17Z","history":[{"date":"2026-10-19","type":"first_seen","status":"unavailable"}]},{"id":157029625,"repo":"mozilla/ssm-acquire","listed_as":"mozilla/ssm-acquire","name":"SSM-Acquire","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"A python module for orchestrating content acquisitions and analysis via amazon ssm.","license":"MPL-2.0","stars":58,"archived":false,"last_commit":"2019-08-06T15:27:02Z","days_since_commit":2631,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":157029625,"owner_id":131524,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":215886590,"repo":"duo-labs/cloudtrail-partitioner","listed_as":"duo-labs/cloudtrail-partitioner","name":"cloudtrail-partitioner","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"","license":"BSD-3-Clause","stars":159,"archived":false,"last_commit":"2021-05-11T12:26:55Z","days_since_commit":1987,"release":{"tag":"1.0.0.1","date":"2020-04-23T18:25:33Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":215886590,"owner_id":10833831,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":224242354,"repo":"andrewkrug/fargate-ir","listed_as":"andrewkrug/fargate-ir","name":"fargate-ir","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Proof of concept incident response demo using SSM and AWS Fargate.","license":"other","stars":15,"archived":false,"last_commit":"2019-12-05T17:38:11Z","days_since_commit":2510,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":224242354,"owner_id":2502523,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":160749874,"repo":"endgameinc/aws-logsearch","listed_as":"endgameinc/aws-logsearch","name":"aws-logsearch","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"","license":"MIT","stars":25,"archived":false,"last_commit":"2018-12-10T15:48:14Z","days_since_commit":2870,"release":{"tag":"0.0.1","date":"2018-12-10T17:53:51Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":160749874,"owner_id":1102250,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":217400002,"repo":"endgameinc/varna","listed_as":"endgameinc/varna","name":"Varna","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Varna: Quick & Cheap AWS CloudTrail Monitoring with Event Query Language (EQL)","license":"Apache-2.0","stars":52,"archived":false,"last_commit":"2020-02-10T15:40:11Z","days_since_commit":2443,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":217400002,"owner_id":1102250,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":184559940,"repo":"mlevit/aws-auto-remediate","listed_as":"servian/aws-auto-remediate","name":"aws-auto-remediate","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Open source application to instantly remediate common security issues through the use of AWS Config","license":"GPL-3.0","stars":217,"archived":true,"last_commit":"2020-09-03T22:55:20Z","days_since_commit":2236,"release":{"tag":"v1.0","date":"2019-05-20T13:22:44Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"renamed","from":"servian/aws-auto-remediate","to":"mlevit/aws-auto-remediate"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":184559940,"owner_id":233717,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":215863078,"repo":"panther-labs/panther-analysis","listed_as":"panther-labs/panther-analysis","name":"panther-labs","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Built-in Panther detection rules and policies","license":"Apache-2.0","stars":471,"archived":false,"last_commit":"2026-10-09T14:52:55Z","days_since_commit":10,"release":{"tag":"v3.114.0","date":"2026-08-27T18:42:45Z","assets":2,"verification":"signature"},"weeks":[12,5,5,5,17,7,8,4,6,0,10,16,4,4,9,6,9,0,13,9,6,8,7,2,6,13,4,5,8,1,6,0,12,4,5,2,18,0,8,0,9,0,1,0,1,2,0,0,4,2,0,0],"advisories":[],"status":"active","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":215863078,"owner_id":42053323,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":275909834,"repo":"easttimor/aws-incident-response","listed_as":"easttimor/aws-incident-response","name":"aws-incident-response","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"","license":"MIT","stars":378,"archived":false,"last_commit":"2024-02-23T16:47:38Z","days_since_commit":969,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":275909834,"owner_id":6775737,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":238205900,"repo":"google/cloud-forensics-utils","listed_as":"google/cloud-forensics-utils","name":"cloud-forensics-utils","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Python library to carry out DFIR analysis on the Cloud","license":"Apache-2.0","stars":511,"archived":false,"last_commit":"2022-03-21T14:06:02Z","days_since_commit":1673,"release":{"tag":"20260917","date":"2026-09-17T03:08:57Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":238205900,"owner_id":1342004,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":237674167,"repo":"WarnerMedia/aws-fast-fixes","listed_as":"WarnerMedia/aws-fast-fixes","name":"aws-fast-fixes","category":"cloud-security","subcategory":"Digital Forensics and Incident Response","source":"my-arsenal-of-aws-security-tools","description":"Scripts to quickly fix security and compliance issues","license":"Apache-2.0","stars":108,"archived":true,"last_commit":"2020-09-14T09:37:05Z","days_since_commit":2226,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":237674167,"owner_id":61422124,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":7646755,"repo":"hiddenillusion/AnalyzePE","listed_as":"hiddenillusion/AnalyzePE","name":"AnalyzePE","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.","license":"","stars":211,"archived":false,"last_commit":"2014-01-24T03:17:31Z","days_since_commit":4651,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":7646755,"owner_id":1418309,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":97053386,"repo":"airbnb/binaryalert","listed_as":"airbnb/binaryalert","name":"BinaryAlert","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.","license":"Apache-2.0","stars":1457,"archived":false,"last_commit":"2020-01-23T22:49:53Z","days_since_commit":2460,"release":{"tag":"v1.2.0","date":"2018-09-05T20:29:46Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":97053386,"owner_id":698437,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":272815213,"repo":"mandiant/capa","listed_as":"fireeye/capa","name":"capa","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"The FLARE team's open-source tool to identify capabilities in executable files.","license":"Apache-2.0","stars":6256,"archived":false,"last_commit":"2026-10-16T14:37:43Z","days_since_commit":3,"release":{"tag":"v10.0.0","date":"2026-10-16T14:03:38Z","assets":6,"verification":"none"},"weeks":[7,6,5,9,6,6,5,13,0,6,11,9,10,7,6,1,9,11,8,9,13,5,12,8,8,119,8,13,17,15,6,6,8,7,2,0,0,4,9,6,1,16,3,2,0,10,1,0,0,10,11,0],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"fireeye/capa","to":"mandiant/capa"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":272815213,"owner_id":331209,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":40277722,"repo":"EmersonElectricCo/fsf","listed_as":"EmersonElectricCo/fsf","name":"File Scanning Framework","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"File Scanning Framework","license":"Apache-2.0","stars":294,"archived":false,"last_commit":"2019-01-28T16:29:14Z","days_since_commit":2821,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":40277722,"owner_id":11926385,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":37336218,"repo":"cmu-sei/pharos","listed_as":"cmu-sei/pharos","name":"fn2yara","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Automated static analysis tools for binary programs","license":"other","stars":1739,"archived":false,"last_commit":"2026-08-03T13:09:04Z","days_since_commit":77,"release":null,"weeks":[0,3,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,10,1,12,1,5,6,2,1,0,5,0,0,0,0,1,0,0,0,14,1,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":37336218,"owner_id":12465755,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":104569410,"repo":"uppusaikiran/generic-parser","listed_as":"uppusaikiran/generic-parser","name":"Generic File Parser","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"A Single Library Parser to extract meta information,static analysis and detect macros within the files.","license":"MIT","stars":3,"archived":false,"last_commit":"2018-09-14T12:38:26Z","days_since_commit":2957,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":104569410,"owner_id":9650342,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":4636548,"repo":"jessek/hashdeep","listed_as":"jessek/hashdeep","name":"hashdeep","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"","license":"other","stars":789,"archived":false,"last_commit":"2017-08-24T15:51:32Z","days_since_commit":3343,"release":{"tag":"v4.4","date":"2014-01-29T20:34:58Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":4636548,"owner_id":1842175,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":27571466,"repo":"gurnec/HashCheck","listed_as":"gurnec/HashCheck","name":"HashCheck","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"HashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org","license":"other","stars":2094,"archived":false,"last_commit":"2016-09-07T22:34:24Z","days_since_commit":3693,"release":{"tag":"v2.4.0","date":"2016-09-07T22:05:44Z","assets":2,"verification":"checksum"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"checksum_only"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":27571466,"owner_id":2966862,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":42738299,"repo":"Dynetics/Malfunction","listed_as":"Dynetics/Malfunction","name":"Malfunction","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Malware Analysis Tool using Function Level Fuzzy Hashing","license":"LGPL-2.1","stars":191,"archived":false,"last_commit":"2015-12-15T18:07:07Z","days_since_commit":3961,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":42738299,"owner_id":13436913,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":40815641,"repo":"JusticeRage/Manalyze","listed_as":"JusticeRage/Manalyze","name":"Manalyze","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"A static analyzer for PE executables.","license":"GPL-3.0","stars":1150,"archived":false,"last_commit":"2026-08-29T08:19:58Z","days_since_commit":51,"release":{"tag":"v1.0.0","date":"2026-07-21T15:04:19Z","assets":3,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,4,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,1,0,38,0,0,0,0,0,0,0,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":40815641,"owner_id":6743798,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":21874600,"repo":"KoreLogicSecurity/mastiff","listed_as":"KoreLogicSecurity/mastiff","name":"MASTIFF","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Malware static analysis framework","license":"","stars":184,"archived":true,"last_commit":"2015-09-23T01:26:56Z","days_since_commit":4044,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":21874600,"owner_id":6288376,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":33875018,"repo":"mitre/multiscanner","listed_as":"mitre/multiscanner","name":"MultiScanner","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Modular file scanning/analysis framework","license":"other","stars":620,"archived":false,"last_commit":"2019-01-28T14:07:45Z","days_since_commit":2821,"release":{"tag":"2.0.0","date":"2019-01-28T18:56:44Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":33875018,"owner_id":44968,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":159678706,"repo":"horsicq/Nauz-File-Detector","listed_as":"horsicq/Nauz-File-Detector","name":"Nauz File Detector(NFD)","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Linker/Compiler/Tool detector  for Windows, Linux and MacOS.","license":"MIT","stars":585,"archived":false,"last_commit":"2026-10-19T20:16:20Z","days_since_commit":0,"release":{"tag":"0.09","date":"2022-10-26T12:43:36Z","assets":17,"verification":"none"},"weeks":[31,32,20,28,31,29,34,31,39,21,21,34,17,15,12,10,19,13,26,29,44,34,33,45,52,39,33,37,33,17,29,2,1,3,3,0,10,1,21,37,16,76,23,30,14,20,4,7,7,3,15,2],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":159678706,"owner_id":7762949,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":8523415,"repo":"rjhansen/nsrllookup","listed_as":"rjhansen/nsrllookup","name":"nsrllookup","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Checks with NSRL RDS servers looking for for hash matches","license":"ISC","stars":116,"archived":false,"last_commit":"2021-02-26T18:55:24Z","days_since_commit":2061,"release":{"tag":"1.4.2","date":"2019-09-16T10:28:16Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":8523415,"owner_id":346091,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":27508651,"repo":"sooshie/packerid","listed_as":"sooshie/packerid","name":"packerid","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"","license":"","stars":50,"archived":false,"last_commit":"2020-04-01T15:53:44Z","days_since_commit":2392,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":27508651,"owner_id":3171017,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":17687689,"repo":"guelfoweb/peframe","listed_as":"guelfoweb/peframe","name":"PEframe","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.","license":"","stars":628,"archived":false,"last_commit":"2021-07-25T17:24:25Z","days_since_commit":1912,"release":{"tag":"6.0.3","date":"2019-07-03T00:21:56Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":17687689,"owner_id":41558,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":13143236,"repo":"struppigel/PortEx","listed_as":"katjahahn/PortEx","name":"PortEx","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness","license":"Apache-2.0","stars":543,"archived":false,"last_commit":"2026-10-13T06:01:09Z","days_since_commit":6,"release":{"tag":"v5.0.7","date":"2026-10-11T05:31:10Z","assets":5,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,4,6,0],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"katjahahn/PortEx","to":"struppigel/PortEx"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":13143236,"owner_id":4398909,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":216696377,"repo":"ev-flow/quark-engine","listed_as":"quark-engine/quark-engine","name":"Quark-Engine","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"","license":"GPL-3.0","stars":1734,"archived":false,"last_commit":"2026-10-17T03:51:00Z","days_since_commit":2,"release":{"tag":"v26.10.1","date":"2026-10-10T06:22:28Z","assets":0,"verification":null},"weeks":[1,1,2,1,3,1,1,8,4,0,6,2,2,2,2,1,0,3,6,4,1,3,5,2,4,2,1,1,1,4,1,1,2,1,5,1,4,2,2,3,2,2,3,1,3,1,1,1,2,1,1,0],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"quark-engine/quark-engine","to":"ev-flow/quark-engine"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":216696377,"owner_id":57204411,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":15494190,"repo":"Neo23x0/yarGen","listed_as":"Neo23x0/yarGen","name":"Yara rules generator","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"yarGen is a generator for YARA rules","license":"other","stars":1818,"archived":false,"last_commit":"2026-01-10T15:02:41Z","days_since_commit":282,"release":{"tag":"0.23.4","date":"2020-12-29T12:59:13Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":15494190,"owner_id":2851492,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":145668723,"repo":"uppusaikiran/yara-finder","listed_as":"uppusaikiran/yara-finder","name":"Yara Finder","category":"malware-analysis","subcategory":"Detection and Classification","source":"awesome-malware-analysis","description":"Simple tool to find the yara matches on a file","license":"MIT","stars":2,"archived":false,"last_commit":"2018-08-27T18:44:11Z","days_since_commit":2975,"release":{"tag":"1.0.0","date":"2018-08-24T13:24:58Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":145668723,"owner_id":9650342,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":2419727,"repo":"de4dot/de4dot","listed_as":"0xd4d/de4dot","name":"de4dot","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":".NET deobfuscator and unpacker.","license":"GPL-3.0","stars":7426,"archived":true,"last_commit":"2020-08-29T08:14:55Z","days_since_commit":2242,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"archived","signals":[{"type":"renamed","from":"0xd4d/de4dot","to":"de4dot/de4dot"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":2419727,"owner_id":67931943,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"archived"}]},{"id":52993349,"repo":"mandiant/flare-floss","listed_as":"fireeye/flare-floss","name":"FLOSS","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.","license":"Apache-2.0","stars":4195,"archived":false,"last_commit":"2026-10-19T19:27:44Z","days_since_commit":0,"release":{"tag":"v3.2.0","date":"2026-10-16T10:51:32Z","assets":3,"verification":"none"},"weeks":[6,4,0,0,0,4,0,2,0,0,3,15,4,0,1,0,2,0,11,7,9,2,12,3,8,13,0,3,0,6,7,7,13,3,1,5,39,26,7,28,11,122,89,69,27,3,9,0,6,25,13,6],"advisories":[],"status":"active","signals":[{"type":"renamed","from":"fireeye/flare-floss","to":"mandiant/flare-floss"},{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":52993349,"owner_id":331209,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":7761309,"repo":"hiddenillusion/NoMoreXOR","listed_as":"hiddenillusion/NoMoreXOR","name":"NoMoreXOR","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"Tool to help guess a files 256 byte XOR key by using frequency analysis","license":"","stars":90,"archived":false,"last_commit":"2018-06-11T11:16:36Z","days_since_commit":3052,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":7761309,"owner_id":1418309,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":34022941,"repo":"BromiumLabs/PackerAttacker","listed_as":"BromiumLabs/PackerAttacker","name":"PackerAttacker","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"C++ application that uses memory and code hooks to detect packers","license":"GPL-2.0","stars":275,"archived":false,"last_commit":"2018-03-05T08:12:27Z","days_since_commit":3150,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":34022941,"owner_id":14301580,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":249959615,"repo":"extremecoders-re/pyinstxtractor","listed_as":"extremecoders-re/pyinstxtractor","name":"PyInstaller Extractor","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"PyInstaller Extractor","license":"GPL-3.0","stars":4508,"archived":false,"last_commit":"2026-07-03T09:00:10Z","days_since_commit":108,"release":{"tag":"2026.07","date":"2026-07-22T09:09:38Z","assets":0,"verification":null},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"slowing","signals":[],"checked":"2026-10-19T22:22:17Z","pin":{"id":249959615,"owner_id":12072382,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"slowing"}]},{"id":47907821,"repo":"rocky/python-uncompyle6","listed_as":"rocky/python-uncompyle6","name":"uncompyle6","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"A cross-version Python bytecode decompiler","license":"GPL-3.0","stars":4332,"archived":false,"last_commit":"2026-10-05T11:56:58Z","days_since_commit":14,"release":{"tag":"3.9.3","date":"2025-09-29T11:22:00Z","assets":26,"verification":"none"},"weeks":[0,0,2,2,1,0,0,0,0,0,2,0,0,0,0,1,0,0,0,0,0,0,0,0,1,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,1,0,0],"advisories":[],"status":"active","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":47907821,"owner_id":8851,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"active"}]},{"id":169604732,"repo":"unipacker/unipacker","listed_as":"unipacker/unipacker","name":"un{i}packer","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"Automatic and platform-independent unpacker for Windows binaries based on emulation","license":"GPL-2.0","stars":783,"archived":false,"last_commit":"2025-08-18T16:24:51Z","days_since_commit":427,"release":{"tag":"1.0.8","date":"2024-05-21T15:52:17Z","assets":1,"verification":"none"},"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"unsigned_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":169604732,"owner_id":47426415,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":45771338,"repo":"malwaremusings/unpacker","listed_as":"malwaremusings/unpacker","name":"unpacker","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"Automated malware unpacker","license":"","stars":122,"archived":false,"last_commit":"2016-03-05T07:34:09Z","days_since_commit":3880,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":45771338,"owner_id":11253746,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":7375957,"repo":"tomchop/unxor","listed_as":"tomchop/unxor","name":"unxor","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"unXOR will search a XORed file and try to guess the key using known-plaintext attacks.","license":"Apache-2.0","stars":145,"archived":false,"last_commit":"2020-04-23T17:04:14Z","days_since_commit":2370,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":7375957,"owner_id":1257972,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":11034958,"repo":"jnraber/VirtualDeobfuscator","listed_as":"jnraber/VirtualDeobfuscator","name":"VirtualDeobfuscator","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"Reverse engineering tool for virtualization wrappers","license":"","stars":152,"archived":false,"last_commit":"2023-09-07T15:20:45Z","days_since_commit":1138,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":11034958,"owner_id":938154,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]},{"id":1267824,"repo":"hellman/xortool","listed_as":"hellman/xortool","name":"xortool","category":"malware-analysis","subcategory":"Deobfuscation","source":"awesome-malware-analysis","description":"A tool to analyze multi-byte xor cipher","license":"","stars":1492,"archived":false,"last_commit":"2025-05-21T12:05:21Z","days_since_commit":516,"release":null,"weeks":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],"advisories":[],"status":"inactive","signals":[{"type":"no_license"},{"type":"no_release"}],"checked":"2026-10-19T22:22:17Z","pin":{"id":1267824,"owner_id":571028,"pinned":"2026-10-19"},"history":[{"date":"2026-10-19","type":"first_seen","status":"inactive"}]}]}