Koen Van Impe

tools. Different tools, koen.vanimpe@cudeso.be

misp2sentinel. MISP to Sentinel integration

OPML-Security-Feeds. A list of OPML Security Feeds

misp-tip-of-the-week. A collection of tips for using MISP.

proof-value-cti. Repository documenting how Threat Intelligence and / or a Threat Intelligence Platform can prove its value to an organisation.

cudeso-honeypot. Honeypot repo

ulogd-viz. Visualisation of ulogd / ufw / iptables data

dfir-iris-misp-timesketch. Scripts to integrate DFIR-IRIS, MISP and TimeSketch

security-tools. Security tools, scanners, exploit code

CSIRT-Jump-Bag. CSIRT Jump Bag

host-enrich. Enrich a host with open source security information

misp-scraper. A web scraper to create MISP events and reports

misp-training-environment. Setting up a training environment for MISP

misp-reporting. A package to create HTML MISP reports, including volume of trending events and attributes, evens received from key organisations and target sector and country.

misp-usergroups. MISP User Groups

elastic-dfir-cluster. Elastic cluster for DFIR

security-screening. Security screening scripts

censys-certif-crawl. Crawl certificate information from censys

spiderfoot. SpiderFoot, the open source footprinting and intelligence-gathering tool.

ics-csirt-website. Website of https://www.ics-csirt.io/

misp_to_zeek. Export MISP indicators to Zeek intel framework

mispbot. A simple tool to allow users to interact with MISP via Mastodon or Twitter.

SoD-Matrix. The Segregation (or separation) of Duties (SoD) Matrix for CSIRTs, LEA and Judiciary

tweetsniff. Grab a Twitter user timeline for further processing (storing to Elasticsearch, highligthing, etc)

rsit-attck. Link RSIT with ATT&CK

digital-footprint-light. digital-footprint-light

ics-csirt. Resources for ICS-CSIRT

Applied-Crypto-Hardening. Paper (DRAFT) on Best Current Practices regarding the configuration of cyptographic tools and online communication

plantendb. Plantendatabase in Google Sheets

lookyloo. Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.

cocktailparty. CocktailParty is a data broker system based on phoenix framework

misp-modules. Modules for expansion services, import and export in MISP

PyOTI. Python library for threat intelligence

MISP-tools. Import CrowdStrike Threat Intelligence into your instance of MISP

Hunting-Queries-Detection-Rules. KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

Log4jCenter. Exploiting CVE-2021-44228 in vCenter for remote code execution and more.

jupyter-collection. Collection of Jupyter Notebooks by @fr0gger_

sectemplates. Open source templates you can use to bootstrap your security programs

misp-basic-cicd. HCL

misp-to-sentinel. Azure function to insert MISP data in to Azure Sentinel

awesome-chatgpt-prompts. This repo includes ChatGPT prompt curation to use ChatGPT better.

IntelArchitectureMap. Intelligence Architecture Mind Map

ransomwatch. a ransomware-group observatory 🧅👹

TIBER-Cases. TIBER-Cases is a project created to give cases of The Hive platform for Threat Intelligence Analysts mainly. All the cases are mapped to TIBER-EU processes.

process_lifecycle. List of Incident Response and Threat Intelligence Processes and Lifecycles

intelmq-demo-web. intelmq-demo-web

PyMISP-docker. Docker images for PyMISP

domain-propagation. Domain propagation on blocklist test

http-screenshot. http-screenshot NSE script for nmap

MOSP-models. Models for MONARC Objects Sharing Platform