Threat Management for Incident Response

HYAS Insight is a threat intelligence platform that provides infrastructure intelligence and cyber threat hunting capabilities for security operations, fraud investigations, and adversary profiling.

The Ransomware Tool Matrix is a repository that lists and categorizes tools used by ransomware gangs, aiding in threat hunting, incident response, and adversary emulation.

Provides advanced external threat intelligence to help organizations proactively identify and mitigate potential security threats.

Facilitating exchange of information and knowledge to collectively protect against cyberattacks.

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol, with a focus on incident handling automation and threat intelligence processing.

PyIOCe is a Python-based OpenIOC editor that enables security professionals to create, edit, and manage Indicators of Compromise for threat intelligence and incident response operations.

n6 is a network security incident exchange system that collects, manages, and distributes threat and incident data through REST API and web interfaces for authorized users.

Daily feed of bad IPs with blacklist hit scores for cybersecurity professionals to stay informed about malicious IP addresses.

OSTrICa is an open source plugin-based framework that collects and visualizes threat intelligence data from various sources to help cybersecurity professionals correlate IoCs and enhance their defensive capabilities.

Repository of scripts, signatures, and IOCs related to various malware analysis topics.

Dataplane.org is a nonprofit organization providing free data, tools, and analysis to increase awareness of Internet trends, anomalies, threats, and misconfigurations.

A comprehensive list of IP addresses for cybersecurity purposes, including threat intelligence, incident response, and security research.

A cybersecurity concept categorizing indicators of compromise based on their level of difficulty for threat actors to change.

A curated collection of companies that have publicly disclosed adversary tactics, techniques, and procedures following security breaches.

Repository of APT-related documents and notes sorted by year.

Freely available network IOCs for monitoring and incident response

The Trystero Project is a threat intelligence platform that measures email security efficacy and provides various tools and resources, while VMware Carbon Black offers endpoint protection and workload security solutions.

The Cybersecurity and Infrastructure Security Agency (CISA) is a government agency that provides alerts, advisories, and resources to help protect the United States' critical infrastructure from cyber threats.

Pulsedive is a threat intelligence platform that provides frictionless threat intelligence for growing teams, offering features such as indicator enrichment, threat research, and API integration.

Tools to export data from MISP MySQL database for post-incident analysis and correlation.