Discover the best Threat Intelligence open source repositories on GitHub. Explore trending tools, live star counts, source code, and developer projects updated daily.
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.
Comprehensive 2026 OSINT guide — 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
10-20x more blocks for your CrowdSec bouncers — 120k+ IPs from 32 free threat feeds
Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
Modules for expansion services, enrichment, import and export in MISP and other tools.
OpenCTI Connectors
Awesome Security lists for SOC/CERT/CTI
The recursive internet scanner for hackers. 🧡
The FLARE team's open-source tool to identify capabilities in executable files.
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats
Real-time OSINT command center for the Iran/Israel and Russia/Ukraine theaters — 50+ live open-source intelligence sources (news, Telegram, military aircraft & naval tracking, missile alerts, prediction & defense markets) in one dashboard. No API keys. Free. Next.js + TypeScript.
A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.
Zeek-Formatted Threat Intelligence Feeds
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
Knock-Knock: A Live, Multi-Protocol Honeypot Dashboard of Internet Break-in Attempts - 13 Protocols, an Extensible Framework, and a Threat-Intelligence Database Serving a Public IP Blocklist Feed