YARA is a pattern matching engine and binary analysis tool used to identify and classify malware samples. It functions as a malware research framework that allows for the definition of file descriptions and detection rules to find indicators of compromise within binaries. The system enables the creation of custom detection rules using strings, wildcards, and regular expressions. These rules use boolean logic to match textual or binary patterns, allowing for the classification of files into specific malware families and the automation of threat intelligence. The engine utilizes Aho-Corasick s
IntelOwl is a threat intelligence platform and security orchestration engine designed to aggregate, analyze, and enrich security observables. It functions as a security incident investigation tool and a threat intelligence aggregator, collecting data on files, domains, and IP addresses from diverse internal and external sources. The system differentiates itself through playbook-based workflow automation, allowing users to define reusable sequences of analysis tasks that trigger subsequent jobs based on prior outputs. It unifies disparate security data into a common schema and utilizes protoco
This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as
T-Pot is a multi-honeypot orchestration platform and threat intelligence collector. It utilizes a Docker-based security sandbox to deploy and manage a collection of diverse decoy services that simulate vulnerable targets to lure attackers and record their activity. The system features a distributed sensor network where remote nodes capture attack logs and transmit them via encrypted communication to a central hub. This central hub employs an analytics stack to transform raw logs into geographic maps and interactive dashboards for adversary behavior visualization. To increase the realism of si
🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.
The main features of tenzir/threatbus are: Detection and Hunting Tools, Threat Intelligence.
Open-source alternatives to tenzir/threatbus include: intelowlproject/intelowl — IntelOwl is a threat intelligence platform and security orchestration engine designed to aggregate, analyze, and… virustotal/yara — YARA is a pattern matching engine and binary analysis tool used to identify and classify malware samples. It functions… misp/misp — MISP is an open-source threat intelligence sharing platform designed for collecting, storing, and distributing… dtag-dev-sec/tpotce — T-Pot is a multi-honeypot orchestration platform and threat intelligence collector. It utilizes a Docker-based… alexandreborges/malwoverview — This project is a Python command-line security tool and malware analysis framework designed for threat intelligence… neo23x0/loki — Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a…