ACE

自动收集与丰富 自动收集与丰富（ACE）平台是一套供威胁猎手使用的工具，用于从网络中的多个端点收集数据并自动进行数据丰富。数据通过在每个计算机上运行脚本收集，无需在目标上安装任何软件。ACE 支持从 Windows、macOS 和 Linux 主机收集数据。 ACE 旨在通过提供凭据管理、调度、集中式脚本管理和远程文件下载，简化跨环境远程收集数据的流程。ACE 旨在通过收集和丰富数据来补充 SIEM；最终分析最适合使用 Splunk、ELK 等 SIEM 工具或分析人员偏好的工具。 为什么使用 ACE？ ACE 源于在常见限制条件下执行入侵评估的需求： 无法在目标主机上安装专用软件代理。...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

MalPipe

MalPipe root@kitploit: //\ | | / / \ / | |/ // | ' \ / \ / //\ \ | | / /| | | | / / /,|/ || ./ | || MalPipe 是一个模块化的恶意软件（及指标）收集与处理框架。它被设计用于从多个源拉取恶意软件、域名、URL 和 IP 地址，丰富收集到的数据并导出结果。 目前支持以下源： VirusTotal https://www.virustotal.com MalShare https://malshare.com/ BambenekFeeds...

crime-mapper

Habilitando investigaciones cibernéticas desde un navegador Una herramienta prototipo para mapear delitos cibernéticos Creado por @UKDanielCard ¡La versión experimental es la versión viva y de vanguardia Live Demo es principalmente donde almaceno una versión relativamente estable... ¡pero todo es...

ThreatSentry-AI

ThreatSentry AI：AI 驱动的威胁狩猎工具 自动进行外部资产发现，通过多源数据智能丰富，并利用集成机器学习预测和优先处理风险。将警报疲劳转化为可操作的情报。 🚀 使命宣言 ThreatSentry AI 通过智能风险优先级排序，消除安全警报疲劳，实现主动威胁狩猎。它结合了自动化资产发现、多源数据丰富和高级机器学习，将原始安全数据转化为可操作的情报。 👨‍💻 作者与致谢 项目负责人： EclipseManic 开发说明： 这个全面的企业安全平台由一位开发者在 AI 开发工具的协助下（用于代码生成、优化和文档）进行架构和开发——证明了 AI 增强的软件工程在复杂系统中的可行性。 📋...

kev-investigator

KEV Investigator An automated investigation draft generator f...

The Backlog Became Policy

& In February, we called the gap between CVE disclosure and scanner signatures the "breach zone." On April 15, 2026, NIST made that gap permanent — and signatureless detection stopped being an advantage. It became a requirement. This post updates Attackers Don't Need Signatures. Neither Should Yo...

Exploit for Code Injection in Pivotal_Software Spring_Data_Commons

SpringBoot-Toolkit An interactive penetration-testing tool de...

Toward Cybersecurity-Expert Small Language Models

Large language models LLMs are transforming everyday applications, yet deployment in cybersecurity lags due to a lack of high-quality, domain-specific models and training datasets. To address this gap, we present CyberPal 2.0, a family of cybersecurity-expert small language models SLMs ranging fr...

Nemesis - An Offensive Data Enrichment Pipeline

Nemesis is an offensive data enrichment pipeline and operator support system. Built on Kubernetes with scale in mind, our goal with Nemesis was to create a centralized data processing platform that ingests data produced during offensive security assessments. Nemesis aims to automate a number of...

“The mother of all breaches”: 26 billion records found online [Updated]

Security researchers have discovered billions of exposed records online, calling it the "mother of all breaches". However, the dataset doesnt seem to be from one single data breach, but more a compilation of multiple breaches. These sets are often created by data enrichment companies. Data...

Excelerating Analysis, Part 2 — X[LOOKUP] Gon’ Pivot To Ya

In December 2019, we published a blog post on augmenting analysis using Microsoft Excel for various data sets for incident response investigations. As we described, investigations often include custom or proprietary log formats and miscellaneous, non-traditional forensic artifacts. There are, of...

Clustering App Attacks with Machine Learning Part 1: A Walk Outside the Lab

A lot of research has been done on clustering attacks of different types using machine learning algorithms with high rates of success. Much of it from the comfort of a research lab, with specific datasets and no performance limitations. At Imperva, our research is done for the benefit of real...

ACE - Automated, Collection, and Enrichment Platform

The Automated Collection and Enrichment ACE platform is a suite of tools for threat hunters to collect data from many endpoints in a network and automatically enrich the data. The data is collected by running scripts on each computer without installing any software on the target. ACE supports...

Open Source OpenSOC Security Analytics Framework Released

Cisco announced today that it has made available through open source a framework that integrates data analytics tools into security operations. “The OpenSOC framework helps organizations make big data part of their technical security strategy by providing a platform for the application of anomaly...