15 public GitHub projects spanning detection engineering, threat intelligence, AI-assisted investigations, and practical SOC tooling. Explore the source and documentation for each project.
Bulk IOC enrichment with VirusTotal, AbuseIPDB, and geolocation, presented in a Next.js and Flask dashboard with streaming results.
ioc-enrichment-console
View repositoryA staged CTI workflow connecting intelligence analysis, detection engineering, automation, and incident reporting.
cti-automation-chain
View repositoryA local prompt workbench and OpenCode operating guide for preparing and reviewing AI-assisted security investigations.
SOC-Nemotron-CLI
View repositoryWindows-focused prompt preparation and OpenCode guidance, including Windows event log review and investigation workflows.
SOC-Nemotron-CLI-Windows
View repositoryLinux-focused prompt preparation and OpenCode guidance for evidence review and security investigation workflows.
SOC-Nemotron-CLI-Linux
View repositoryElastic Security detection rules in TOML format, mapped to MITRE ATT&CK with triage guidance and false-positive considerations.
Safehouse-MITRE-Attack-Detection-Rules-Elastic-ELK
View repositoryIncident response playbooks for Elastic SIEM, covering investigation queries, evidence handling, and response workflows.
elk-ir-playbooks
View repositoryA categorized reference for Kibana Graph and OpenCTI investigations, with query scopes, graph entities, and follow-up pivots.
SIEM-Graph-Investigation-Playbook
View repositoryA phased implementation guide for dark web monitoring with open-source OSINT tools, MISP, ELK, and FortiGate.
SOC-DarkWatch
View repositoryPublic IP indicator feeds for threat intelligence review and integration into security monitoring tools.
Malicious-IP-Threat-List
View repositoryPublic domain indicator feeds for investigating suspicious infrastructure and supporting security monitoring.
Malicious-Domain-Threat-List
View repositoryPublic file-hash indicator feeds for malware intelligence reference and security tooling integration.
Malicious-Hash-Threat-List
View repositoryA documented design for scheduled IOC collection, normalization, and firewall blocklist integration.
sentinel-ioc-block
View repositoryA practical configuration guide for authenticated Nessus vulnerability assessments on Windows and Linux servers.
nessus-authenticated-va-scan-guide
View repositoryA point-in-time Linux hardware and account report with optional FIO disk benchmarks and HTML, TXT, CSV, and JSON output.
system-report-script
View repositoryOngoing series on Medium, Hashnode, and DEV.to covering SOC operations, detection strategy, and CISO-level decision-making.
ExploreCurated threat-intel pulses published on OTX AlienVault, tracking emerging indicators and campaigns.
Explore