pettai

uno

Like uniq, but for logs.

AbuseIO

AbuseIO is a toolkit to receive, process, correlate and notify about abuse reports received by network operators, typically hosting and access providers.

abuseio-ansible

Ansible playbook for installation of AbuseIO

abuseio-docker

Docker image for AbuseIO

artifacts

Digital Forensics Artifact Repository

cloud-to-butt

Chrome extension that replaces occurrences of 'the cloud' with 'my butt'

Cortex-Analyzers

Cortex Analyzers Repository

CortexDocs

Documentation of Cortex

doh-proxy

A proof of concept DNS-Over-HTTPS proxy implementing https://datatracker.ietf.org/doc/draft-ietf-doh-dns-over-https/

flask-rpz-lookup

RPZ lookup tool

Homework

Based on the WWDC 2021 talk titled: Meet the Screen Time API

httpbin

HTTP Request & Response Service, written in Python + Flask.

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

jarm

jc

CLI tool and python library that converts the output of popular command-line tools, file-types, and common strings to JSON, YAML, or Dictionaries. This allows piping of output to tools like jq and simplifying automation scripts.

MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform (formely known as Malware Information Sharing Platform)

misp-docker

A production ready Dockered MISP

misp-modules

Modules for expansion services, import and export in MISP

misp-objects

Definition, description and relationship types of MISP objects

misp-warninglists

Warning lists to inform users of MISP about potential false-positives or other information in indicators

misp_feed

network-testing

Network Testing Tools for testing the Linux network stack

nsd

The NLnet Labs Name Server Daemon (NSD) is an authoritative, RFC compliant DNS nameserver.

phishing_catcher

Phishing catcher using Certstream

sendportal

Open-source self-hosted email marketing. Manage your own newsletters at a fraction of the cost.

sigma

Generic Signature Format for SIEM Systems

sp-gen

Generate metadata for a SWAMID SP

spec2deb

This utility takes a rpm package.spec as input generating a series of debian-specific files like the package.dsc build descriptor and the debian.diff.gz / debian.tar.gz containing the control file and patches. The result is a directory that is ready for dpkg-source to build a *.deb.

unbound

Unbound is a validating, recursive, and caching DNS resolver.

XDP-Firewall

A firewall that utilizes the Linux kernel's XDP hook. The XDP hook allows for very fast network processing on Linux systems. This is great for dropping malicious traffic from a (D)DoS attack. IPv6 is supported with this firewall! I hope this helps network engineers/programmers interested in utilizing XDP!