IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
Distributed malware processing framework based on Python, Redis and S3.
evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.
VINCE is the Vulnerability Information and Coordination Environment developed and used by the CERT Coordination Center to improve coordinated vulnerability disclosure. VINCE is a Python-based web platform.
DomainClassifier is a Python (2/3) library to extract and classify Internet domains/hostnames/IP addresses from raw unstructured text files following their DNS existence, localization or attributes.
BGP ranking is a free software to calculate the security ranking of Internet Service Provider (ASN)
Incident Response Network Tools
Web-based IOC management platform with threat intelligence enrichment for SOC teams
CSV processing and web related data types mutual conversion
Automation SIG
Static configuration extractor for the Karton framework
AutoIt script ripper for Karton framework
File type classifier for the Karton framework.
IntelMQ command line tool to process events and send out email notifications.
A small Flask application that allows for Karton task and queue introspection.
File and analysis artifacts yara matcher for Karton framework
Local plugin for MWDB that scans (re-)uploaded using ClamAV and Yara
Extractor of various archive formats for Karton framework
AnonShield: A scalable, on-premise pseudonymization framework for CSIRT vulnerability data. Combines GPU-accelerated NER, entity caching, and streaming processing for GDPR/LGPD compliance without losing analytical utility.
To associate your repository with the csirt topic, visit your repo's landing page and select "manage topics."