ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and videos, Technical guidelines and important resources about Threat Intelligence.

An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and videos, Technical guidelines and important resources about Threat Detection & Hunting.

Collection of Suricata rule sets that I use modified to my environments.

Threat Feeds, Threat lists, and regular lists of known IP ranges and domains. It updates every 4 hours.

Get the disposition for an observable

FortiGate API (for FortiOS API v2) library wrapper. Active support for core Firewall & System plus DNS Filtering & External ThreatFeed Connector's.

Example scripts for the Threat Response Enrich API

Example scripts for authenticating to the Threat Response APIs

Generates a threat feed IP list from a user-furnished ASN list.

How to install Have I been pwned for Cisco's SecureX walk through using Ubuntu 20.04 as the desktop environment

Example scripts for the Threat Response Response API

Standardized incident response procedures, playbooks, and runbooks for SOC teams protecting critical infrastructure

Velociraptor-inspired DFIR and endpoint investigation lab using MITRE ATT&CK techniques.

AI-powered SOC Analyst Assistant built with Python, FastAPI, LangChain, and MITRE ATT&CK. Automates threat analysis, IOC extraction, attack classification, RAG-based threat intelligence, incident reporting, and SOC workflows through CLI, REST API, and an interactive Streamlit dashboard.

Automated incident response playbooks for security operations