The NGSOTI project is dedicated to training the next generation of Security Operation Center (SOC) operators, focusing on the human aspect of cybersecurity. It underscores the significance of providing SOC operators with the necessary skills and open-source tools to address challenges such as detection engineering, incident response, and threat intelligence analysis. Involving key partners such as CIRCL, Restena, Tenzir, and the University of Luxembourg, the project aims to establish a real operational infrastructure for practical training. This initiative integrates academic curricula with industry insights, offering hands-on experience in cyber ranges.
- vulnerability-lookup Vulnerability-Lookup facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure (CVD).
- poppy Poppy is a Rust crate offering an efficient implementation of Bloom filters. It also includes a command-line utility (also called poppy) allowing users to effortlessly create filters with their desired capacity and false positive probability. Values can be added to the filters via standard input, facilitating the use of this tool in a pipeline workflow.
- kunai Kunai is a powerful tool designed to bring actionable insights for tasks such as security monitoring and threat hunting on Linux systems. Think of it as the Linux counterpart to Sysmon on Windows, tailored for comprehensive and precise event monitoring.
- SkillAegis SkillAegis is a platform to design, run, and monitor exercise scenarios, enhancing skills in applications like MISP and training users in best practices for information management and protective tools. Its gamification system makes learning engaging, ensuring users acquire essential technical skills and adhere to industry standards.
- url-checker-tools is a Python CLI security analysis toolkit that performs comprehensive URL threat assessment through multi-source intelligence gathering. The tool queries external security APIs to collect threat intelligence data. It also includes of POC of leveraging custom YARA rule sets for local content inspection and pattern matching. It synthesizes findings from multiple sources into a unified and configurable security scoring and detailed report, providing actionable insights about URL safety. Designed as the backend engine for security analysis, it delivers structured JSON output compatible with automated workflows. Built for integration with the url-checker web platform, it serves as the heavy-lifting component for asynchronous security assessments. But the Command Line Interface also enables standalone usage for security researchers, incident response teams and personal usage.