项目说明
Defensi Hub
A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts.
<p align="center">اللَّهُمَّ صَلِّ علَى مُحَمَّدٍ وعلَى آلِ مُحَمَّدٍ، كما صَلَّيْتَ علَى إبْرَاهِيمَ وعلَى آلِ إبْرَاهِيمَ؛ إنَّكَ حَمِيدٌ مَجِيدٌ.</p>
<p align="center">اللَّهُمَّ بَارِكْ علَى مُحَمَّدٍ وعلَى آلِ مُحَمَّدٍ، كما بَارَكْتَ علَى إبْرَاهِيمَ وعلَى آلِ إبْرَاهِيمَ؛ إنَّكَ حَمِيدٌ مَجِيدٌ.</p>
<div id="header" align="center">
<img src="
<img src="
<img src="
<img src="
<img src="
<img src="
<img src="
<a href="
<img src="
</a>
<a href="
<img src="
</a>
</div>
> Pro Tip: Use Ctrl+F / Cmd+F to quickly find resources by keyword!
---
📂 Repository Structure
Training Courses
DFIR TrainingCYBER 5WLetsDefend - SOC Analyst Learning PathCyberDefendersPwned LabsHTB - SOC AnalystTHM - SOC Level 1THM - SOC Level 2ACE ResponderXINTRACyber Dojo13CubedSOCRadarAntisyphon TrainingNCSC - Exercise in a BoxIn-Depth In & Threat HuntingStudent SOC Program Foundations trainingCoursera - Security Operations Center (SOC)Web Security AcademyCryptoHackOArticles
AutoIT Payload InjectorWindows Persistence Forensics: Services, Scheduled Tasks, and Autorunsthirdeyeintel - Na the E Cyber Threat Landscape: Insights from ACSC’s 2021-2023 Reportsthirdeyeintel - AI-Enhanced SOCs in 2025: Defenders, Co-Pilots, and the New Cyber Threat Frontierthirdeyeintel - My take on Role of Threat Intelligence in Security Operationsthirdeyeintel - The Future-Ready SOC: A Blueprint for Maturity, Resilience, and Real-World ImpactMITRE ATT&CK®Tuning Detections isn’t Hard Unless You Make it HardDetect FYI - Becoming a Detection Engineering Contractor, Part I — The MotiDetect FYI - Becoming a Detection Engineering Contractor, Part II— The PreparationDetect FYI - Threat Hunting (Suspicious Windows Services)Hackndo - Spray passwords, avoid lockoutsHackndo - NTLM RelayHackndo - Kerberos DelegationPulsedive - Collection through Correlation: Operationalizing IP and Domain Indicators of CompromisePulsedive - Assemblyline 101 - Open Source Malware TriagePulsedive - Phishing Kits 101 & V3B Phishing KitPulsedive - Tool Guide: CyberChef 101Loggly - Windows Logging BasicsLoggly - Troubleshooting with Windows LogsLoggly - Centralizing Windows LogsCrowdStrike - AI SIEMSANS - Incident ResponseSplunk - Security Operation CenterSplunk - Indicators of Compromise (IoCs): An Introductory GuideA Career Guide for Your First Analyst Role and BeyondMeasuring Detection CoA Sysmon Event ID BreakdownRansomware identification for the judicious analystHow SELinux deny rules impro security Documents & Publications
Hack The LogsEvent Log CompendiumThe Base-Rate Fallacy and its Implications for the Difficulty of Intrusion DetectionImplementing SIEM and SOAR platforms: ExecutiBest practices for event logging and threat detectionPriority logs for SIEM ingestion: practitioner guidanceSmall business cyber security guideWindows event logging and forwardingGuide to Security OperationsNo-Budget Li DetectionEngineering E with eBPFThe Fundamental Guide to Building a Better SOCThe State of Security 2023Splunk ES Correlation Searches Best Practices v1.3ohmymalwareBlogs
Awesome Threat Intel BlogsCrowdStrike BlogDetect FYINextron SystemsFalconForceSpecterOpsRed CanaryHuntressSecurity InThe DFIR ReportKnow Your AdCyberTriageHuntressHackForLabCyberdefenseHadesseCrimeDe GuidesExploit ReInfoStealersHackers AriseDaOgminiYouTube Playlists/
What is a SIEMSOC SOC100 Full PlaylistI Want to Be a SOC Analyst, What Do I Do?Malware Traffic Analysis with WiresharkWireshark MasterclassPowerSIEM - Analyzing Sysmon Events with PowerShell - Dynamic Malware AnalysisAd Windows Logging - Finding What AMalicious Document AnalysisUnderstanding Runtime Linking in Windows: A Deep Dive for Reverse Engineers and Malware AnalystsMalware AnalysisIncident Response TrainingDigital ForensicsCyber Threat IntelligenceCyber Threat Intelligence Summit 2024Threat Hunt TrainingThreat Hunting & Incident Response Summit 2021Blue Teaming and Network Defense Series Academy - SOC & IRISO 27001PCI DSSMalware Theory on BlackboardSOC Analyst TrainingShuffle Automation
Introducing Shuffle — an Open Source SOAR platform part 1Getting started with Shuffle — an Open Source SOAR platform part 2Integrating Shuffle with and TheHive — Open Source SOAR part 3Real-time executions and IoC’s with Shuffle, TheHive and MISP — Open Source SOAR part 4CyberSec Frameworks & Models / Risk Assessment
Cyber Kill ChainMITRE ATT&CKISACANISTNIST Risk Assessment TemplatePCI DSSISOHIPPAASTPCOBITCSACIS BenchmarksSCFSOC2FAIRIACSISACESGGitHub Repositories
SOC Analyst NotesSOC-RESSOURCESDetection Engineering Starter PackOSINT DashboardCybersecurity Resources and Learning JourneySplunkAwesome SOC AnalystAwesome SOCBlue Team NotesIncident Response Playbooks Mapped to MITRE Attack Tactics and TechniquesPlaybooks for SOC AnalystsMISP PlaybooksEmail Analysis
How to Get Email HeadersEmail Header AnalyzerE-Mail Header AnalyzerDMARC testerLearn and Test DMARCFree email address toolFile Analysis
oletoolspeepdfCheat Sheets & Tables
RFC EditorSG TCP/IP Ports databaseFileInfoASCII Code TableFile Signatures DatabaseSyscall TablesEDR Telemetry ResourcesAntivirus Event Analysis Cheat SheetCheat Sheets to help you in configuring your systemsTCP/IP and tcpdump Pocket Reference GuideWindows Security Log EventsDigital Forensics and Incident ResponseWebsites and Tools
Detections AISOC Resources for Daily OperationsSuricataSnortWiresharkYARAZeekUbertoothTcpdumpPCAPdroidSniffnetSniffglueNgrepKismetKisMACEttercapDriftnetArkimeAttack Rule Mapendoflife.dateAd Emulation Platform
Atomic Red TeamStratus Red TeamMITRE Caldera™VECTRSplunk Attack Range ⚔️Simulation & EmulationThreat Hunting
MITRE ATT&CKMITRE ATT&CK GroupsThreathunting FrameworksThreat Hunt Book by PredefenderThreat Hunting Maturity Model Explained With ExampleseXtended Threat-informed Defence (XTID)AttackRuleMapThreat Hunting KeywordsNon-Human Identity Threat CenterDNS Abuse Techniques MatrixDetection Engineering Maturity MatrixEvidsMajestic Million WebsitesDFIR
AboutDFIRDFUR DivaDigital Forensics GuideForensic FocusDigital Forensics and Incident ResponseAwesome Incident ResponseIncident-PlaybookRegSeekTimestamp SolverEpoch ConQu1cksc0peDetect-It-EasymalwoDFIRTrack Aurora Incident ResponseFJTA - Forensic Journal Timeline AnalyzerUnix-like Artifacts Collector (UAC)UEFIToolDFIR_ToolbarTheHiveFast Incident ResponseGRR Rapid ResponseDFIR IRISC2-TrackerID RansomwareNo more RansomforensictoolsLiving Off the Living Off the LandUnProtectEchoTrailTrailDiscoverBLADE Framework MatrixARTToolkitExploit NotesCyberChefURL2PNG - Website Screenshot ServiceHardening
Getting Started with ISO 27001CIS BenchmarksHow To Secure A Linux ServerThe Practical Linux Hardening GuideOpenSCAPDevSec ProjectHARDN-XDRHardening Ubuntu. Systemd edition.lynisCyber Threat Intelligence
CrowdStrike - Cyber Threat Intelligence ExplainedCrowdStrike - Attack CrowdStrike - Threat Actors ExplainedCrowdStrike - What is an Attack Surface?Integrating Large Language Models with Knowledge Graphs for Cyber Threat Intelligence Credibility AssessmentAwesome Threat IntelligenceBest Practices for MITRE ATT&CK® MappingCheatsheet: Threat Attribution in Threat IntelligenceCTI-CMMOrange CyberdefenseHacktivist CoalitionsAdThreat Intel BotdeepdarkCTIMISP Galaxy & MISP TaxonomiesGlobal Threat Landscape ReportsCyber Threat Intelligence Platforms
IntelMQMISPOpen-CTIAlienVaultIntelOwlBuild Your Own Cyber Threat Intelligence ProgramBuilding a Cyber Threat Intelligence Platform in 5 stepsMISP Resources Documentation
MISP Categories and Types MISP Project Tools Using the MISP System Attributes REST API Threat Intelligence Best Practices MISP to Splunk Integration (PDF) MISP Instance Sizing MISP Deployment Training (PDF) Feed Metadata Defaults (JSON)MISP Threat IntelKra MISP Series
Part 1: What is MISP? Part 2: Setup Guide Part 3: Creating Events Part 4: Using Feeds Part 5: Searching & Filtering Part 6: API Usage Part 7: Exporting IOCs IoCs & Security Analysis & Threat Intelligence Tools
File ScanHybrid AnalysisANY.RUN Interacti AnalysisSOCRadarthreatYetiMetaDefenderJoe SandboxFileScan.ioURLScan.ioPhishTankOpenPhishPhishing DatabaseAbuseIPDBabuse.chURLVoidIP VoidPalo Alto URL FilterSymantec FilterSymantec IP Reputation InTrend Micro IP Reputation LookupIP Address LookupKaspersky Threat IntelligenceIOC.oneFireHOL IP ListsThreatFeeds.ioWannaBrowserBrowserlingCisco Talos IntelligencePulsedi IntelligenceMyWotGreyNoise BrightCloud URL/IP LookupIBM X-Force ExchangeSpamhaus LookupInQuest Deep File InspectionCrowdSec CTIThreat Zone URL AnalysisCRXplorerIsLegitSiteHaSpydi's ThreatIntel FeedFree Threat Intel/IOC FeedsThreatMon's Daily Command and Control (C2) FeedSophos-originated indicators-of-compromise from published reportsIndicators from Unit 42 Public ReportsopenhuntingFree and Open Source Threat Intelligence Feeds Intelligence Resources
CVSS v4.0FIRST C 4.0 CalculatorNVD CDBugsOWASP Risk Assessment CalculatorCommon Weakness EnumerationCISA Known Exploited Bleeping ComputerCybersecurity NewsSecurity.ioVulDB SearchNational DatabaseC Database ExplorerVDECMend.io Database TrendsCCERT Notes DatabaseMS Security Update GuideExploit KitploitExploit DatabaseSPLOITUSCPoC in GitHubCVE to EPSS ConEPSS API LookupWiz DatabaseThreat Search KEVData Breach & Leak Monitoring Services
Have I Been PwnedAm I BreachedFirefox MonitorLeakPeekDistributed Denial of SecretsWikiLeaksCyber LeaksScattered SecretsDeHashedBreachDirectoryHackCheckIntelligenceXIDStrongIdentity Guard ScanImmuniWeb Dark Web ScanLeak-LookupSnusbaseLeakCheckLeakRadarPrivacy & Image Search Tools
TinEye Reverse Image SearchPimEyes Facial RecognitionHacking Communities/Markets & Resources
Russian MarketCyberNulledCracking ZoneDemon ForumsLeakZoneStart.me Pages
The Ultimate Osint CollectionCyber Threat Intelligencebuild-a-socCTIinfosecForensicsOSINT Darkweb RussiaDark WebThe Ultimate OSINT CollectionOSINT4ALLMain ToolsOSINT Tools & ResourcesOSINT Research PortalSOCMINT ToolkitPrivacy & SecuritySearch EnginesSocial Media Search BookmarksDigital ForensicsDeepfake DetectionIT & CybersecurityMobileToolkitAML ToolboxNixintel's OSINT Resource ListHunt OSINTOSINT Smart FrameworkAsINT CollectionOPSEC Online PrivacyAtoZosintOpen SourceryCyberThreat HuntingOSINT Global Non-USNetwork System AdministrationTerror Finance and Arms DiCybersecurity CTFS ToolsTerrorism FinancingSussex Global AnalysisTracing Arms Identifying CombatantsOnline Extremism TerrorismLearning ResourcesLatest News Articles ReportsTriage In IRDatasets & DatabasesTerrorism Radicalisation Research DashboardCTFPen Testing / Red TeamDFIR JediBusiness ResilienceMalware AnalysisThreat Informed Defense EcosystemInternational Security ResearchOSINT Tools MiscellaneousHuman Resources Counter IntelligenceReddit Communities
Cybersecurity101netsecAskNetsecSecurityCareerAdviceITCareerQuestionsnetsecstudentsblueteamsecredteamsecsecurityCTFRecomputerforensicscryptowebscrapingprivacyPripritryhackmehacktheboxSplunkCryptoCurrencysysadminhardwaretechnologyprogramminglearnprogrammingOSINT Communities
UK OSINTBest OSINT communitiesOSINT UKOSINT FranceOSINT NordOSINT SwitzerlandOsmosis InstituteCyber Social HubOSINT TeamProjet FoxOSINT Medium Bloggers
TechjournalistIgor S. BederovCyberGuyOloyede Olajumoke ElizabethChad WarnerIntelTakesSteTokyo_v2Tom JarvisSomdeJeffrey MaderBenjamin StrickOfficer's NotesChristina LekatiInfoSecSherpa (Tracy Z. Maleeff)wondersmith_raeIntel_InquirerOSINT Resources
Best OSINT booksAwesome OSINT RepositorySocial Media OSINT Tools CollectionSocial Media OSINTAwesome OSINT For EBBOTOSINT Cheat SheetThreat Hunting UsecasesBlue Team Alerts🛡Cybersecurity | Privacy | News 🛡The Hacker NewsBleepingComputerSecurity HarNetsecBlue Team | SOC | DFIR | Cloud SecurityExams & Quizzes
CompTIA Security+ SY0-701 QuizISO 27001 Lead AuditorAiCybr Practice CenterCertPreps项目信息
开发语言：未知
Star 数：16
技术要点
该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。