Blue Team Resources

Analyze suspicious files, URLs, IPs, and domains against 70+ AV engines and threat intel feeds.

Open threat exchange platform with community-sourced IOC pulses, threat reports, and API access.

Open source threat intelligence platform for sharing, storing, and correlating IOCs across organizations.

Globally accessible adversary tactics and techniques knowledge base based on real-world observations.

IOC sharing platform from abuse.ch. Covers malware hashes, IPs, domains, and URLs with API access.

Enterprise-grade threat intelligence from frontline incident responders. Free tier available with limited access.

Simple IOC and YARA rule scanner for endpoint triage. Detects known malware artifacts on live systems.

Industry-standard memory forensics framework. Extract artifacts from RAM dumps across Windows, Linux, and Mac.

Google's remote live forensics framework. Agent-based collection of artifacts from endpoints at scale.

Scalable open source security incident response platform. Integrates with MISP, Cortex, and common SIEM tools.

Federal incident response playbooks for ransomware, phishing, and more. Practical checklists for response teams.

The U.S. government's official CVE repository. CVSS scores, CWE mappings, and CPE data for every published vuln.

Exploit Prediction Scoring System. Probability-based scores for which CVEs are likely to be exploited in the wild.

CVE monitoring with vendor/product subscriptions and alerting. Self-hostable open source version available.

Vulnerability database with exploit availability tracking, timeline data, and countermeasure guidance.

Open source vulnerability scanner from Greenbone. Full-featured network scanning with regularly updated NVTs.

Search engine for internet-connected devices. Find exposed services, banners, and misconfigurations by IP or org.

Attack surface visibility platform. Scans the entire IPv4 space and indexes certificates, protocols, and services.

Visual link analysis tool for mapping relationships between domains, IPs, people, and organizations.

Email discovery and verification. Find email addresses associated with a domain and verify deliverability.

Automated OSINT framework. Aggregates data from 200+ sources on IPs, domains, emails, and usernames.

Search engine for leaked data, darkweb content, and historical records. Indexes pastes, breach data, and more.

Interactive online sandbox. Execute malware in a browser and watch behavior in real time with process tree and network captures.

Free malware analysis service powered by CrowdStrike Falcon Sandbox. Supports PE, Office, PDF, and script files.

Open source malware sandbox focused on config extraction. Supports dozens of malware families with custom signatures.

Community malware repository from abuse.ch. Search and download malware samples by hash, tag, or family.

Mandiant's Windows-based malware analysis distribution. Installs RE tools (IDA, Ghidra, x64dbg, etc.) automatically.

Automated malware unpacking service. Submit packed samples and retrieve unpacked payloads and config extractions.