This project is a SIEM with SIRP and Threat Intel, all in one.

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

🦊 DISINFOX is a threat intelligence exchange platform for disinformation implementing the DISARM framework at its core.

A highly available AWS deployment of the Threat Intelligence platform, OpenCTI using Terraform. Native AWS resources are used where feasible.

Helm chart for Open Cyber Threat Intelligence Platform

Maltego local and server integration for OpenCTI

ThreatCheck - Select any indicator of compromise on any web page - or highlight an entire paragraph from a threat report - and instantly extract and look up every IOC across multiple platforms. No copy-pasting between tabs.

Natural language interface to OpenCTI threat intelligence. Built with Claude Code for $22. Part of Cooper Cyber Coffee.

OpenCTI–Wazuh connector looking for indicators in Wazuh and creating sightings

A repository dedicated to deliver a comprehensive set of tools for integration and convenient use of Kaspersky Threat Intelligence services

Wazuh extension looking up alert data against indicators in OpenCTI threat intel

Welcome to my Cybersecurity Homelab, where I experiment with ethical hacking, penetration testing, network security, AI Agent automation and system hardening. This repo documents the architecture, software stack, configurations, and automation scripts used in my self-hosted cybersecurity lab.

Unofficial OpenCTI Golang Client

Automated threat intelligence collector built with Python and GitHub Actions — fetches recent IOCs from open sources, normalizes and enriches them (IP, URL, hash, CVE), and publishes ready-to-use feeds in CSV, JSON, and STIX formats.

Newsletter hebdomadaire sur les menaces cyber du moment à partir de cluster OpenCTI auto-hebergé

Behavioral similarity engine for APT groups and TTP profiles. Powered by MITRE ATT&CK® and OpenCTI.

A command line tool that turns NVD CVE records into STIX 2.1 Objects.

Watcher is a solution that integrates with security products using IoC (Indicator of Compromise) information gathered through the OpenCTI platform. This integration makes it possible to detect and respond to threats faster.

IgniteGraph is a client layer for using Apache Ignite as a graph database. It is an implementation of the Apache TinkerPop interfaces.

docker-compose configuration to install OpenCTI with connectors (check my blog post for more information)