Skip to content

@OTRF Open Threat Research Forge

All

    Repositories list

    30 repositories

    • ThreatHunter-Playbook

      Public
      A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
      dfirsysmonthreat-hunting
      dfirsysmonthreat-huntinghuntinghuntermitrehypothesishunting-campaignsmitre-attack-db
      Python
      •
      MIT License
      •862•4.6k•6•0•Updated Jan 12, 2026Jan 12, 2026

    • Blacksmith

      Public
      Building environments to replicate small networks and deploy applications
      PowerShell
      •
      GNU General Public License v3.0
      •70•336•2•0•Updated Jan 9, 2026Jan 9, 2026

    • ATTACK-Python-Client

      Public
      Python Script to access ATT&CK content available in STIX via a public TAXII server
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •120•572•2•0•Updated Dec 19, 2025Dec 19, 2025

    • OSSEM-DD

      Public
      OSSEM Data Dictionaries
      Python
      •
      MIT License
      •20•68•10•0•Updated Jan 22, 2025Jan 22, 2025

    • Microsoft-Sentinel2Go

      Public
      Microsoft Sentinel2Go is an open source project developed to expedite the deployment of a Microsoft Sentinel research lab.
      PowerShell
      •
      GNU General Public License v3.0
      •145•597•2•0•Updated Jan 22, 2025Jan 22, 2025

    • GenAI-Security-Adventures

      Public
      Jupyter Notebook
      •
      MIT License
      •16•110•1•1•Updated Jun 2, 2024Jun 2, 2024

    • MEAN

      Public
      Microsoft Entra ID Administration LLM-based Autonomous Agent
      Jupyter Notebook
      •
      MIT License
      •2•8•0•0•Updated Apr 30, 2024Apr 30, 2024

    • Security-Datasets

      Public
      Re-play Security Events
      PowerShell
      •
      MIT License
      •262•1.8k•9•4•Updated Mar 20, 2024Mar 20, 2024

    • infosec-jupyterthon

      Public template
      A community event for security researchers to share their favorite notebooks
      Jupyter Notebook
      •
      GNU General Public License v3.0
      •25•109•0•1•Updated Feb 15, 2024Feb 15, 2024

    • Blog-Website

      Public
      Official OTR Blog Website
      5•2•1•0•Updated Nov 4, 2023Nov 4, 2023

    • OSSEM

      Public
      Open Source Security Events Metadata (OSSEM)
      Python
      •
      MIT License
      •209•1.3k•14•3•Updated Feb 27, 2023Feb 27, 2023

    • BHEU22-ADFS

      Public
      Writing Your Own Ticket to the Cloud Like APT: A Deep-dive to AD FS Attacks, Detections, and Mitigations
      MIT License
      •4•12•0•0•Updated Dec 9, 2022Dec 9, 2022

    • OSSEM-DM

      Public
      OSSEM Detection Model
      Python
      •
      MIT License
      •43•183•11•1•Updated Oct 11, 2022Oct 11, 2022

    • SANS-BlueTeamSummit-2022

      Public
      Repo to track SANS BlueTeam Summit Presentation
      Jupyter Notebook
      •6•23•0•0•Updated Oct 4, 2022Oct 4, 2022

    • OSSEM-CDM

      Public
      OSSEM Common Data Model
      MIT License
      •15•56•16•1•Updated Sep 20, 2022Sep 20, 2022

    • Set-AuditRule

      Public
      Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity
      PowerShell
      •
      GNU General Public License v3.0
      •24•96•1•0•Updated Feb 2, 2022Feb 2, 2022

    • sigma

      Public
      Generic Signature Format for SIEM Systems
      Python
      •2.8k•14•0•0•Updated Oct 27, 2021Oct 27, 2021

    • 2021-OceanLotus-workshop

      Public
      HCL
      •
      MIT License
      •3•19•26•0•Updated Aug 4, 2021Aug 4, 2021

    • openhunt

      Public
      Python
      •7•34•3•0•Updated Jun 22, 2021Jun 22, 2021

    • OSSEM-DD-MASK

      Public
      An extension of the OSSEM-DD repository.
      GNU General Public License v3.0
      •1•1•0•0•Updated May 11, 2021May 11, 2021

    • SimuLand

      Public
      Cloud Templates and scripts to deploy mordor environments
      Shell
      •
      GNU General Public License v3.0
      •21•129•1•0•Updated Mar 3, 2021Mar 3, 2021

    • infosec-jupyter-book

      Public
      The Infosec Community Definitive Guide to Jupyter Notebooks
      Dockerfile
      •
      GNU General Public License v3.0
      •30•134•2•0•Updated Oct 17, 2020Oct 17, 2020

    • notebooks-forge

      Public
      A collection of notebooks built for defensive and offensive operations.
      Jupyter Notebook
      •
      GNU General Public License v3.0
      •24•77•2•0•Updated Oct 13, 2020Oct 13, 2020

    • detection-hackathon-apt29

      Public
      Place for resources used during the Mordor Detection hackathon event featuring APT29 ATT&CK evals datasets
      Jupyter Notebook
      •
      GNU General Public License v3.0
      •39•145•49•0•Updated Oct 12, 2020Oct 12, 2020

    • workshop-ekoparty-bluespace-2020

      Public
      Materiales para enseñar lo básico de Jupyter Notebooks y análisis de data con Pandas
      Dockerfile
      •1•3•0•0•Updated Sep 29, 2020Sep 29, 2020

    • Community-Presentations

      Public
      Slides
      1•1•0•0•Updated Sep 29, 2020Sep 29, 2020

    • bloodhound-notebook

      Public
      BloodHound Cypher Queries Ported to a Jupyter Notebook
      Python
      •
      GNU General Public License v3.0
      •8•53•0•0•Updated Jun 20, 2020Jun 20, 2020

    • OSL

      Public
      A refreshed version of Hyde for Jekyll 3.x and 4.x
      CSS
      •
      Other
      •751•1•0•0•Updated May 27, 2020May 27, 2020

    • bloodhound-notebooks

      Public
      Notebooks created to attack and secure Active Directory environments
      Jupyter Notebook
      •
      GNU General Public License v3.0
      •9•26•0•0•Updated Nov 18, 2019Nov 18, 2019

    • API-To-Event

      Public
      A repo to document API functions mapped to security events across diverse platforms
      GNU General Public License v3.0
      •18•74•0•0•Updated Nov 1, 2019Nov 1, 2019
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.