Repolode
Submit
hslatman

hslatman/awesome-threat-intelligence

A curated Awesome list of threat intelligence resources, covering IP and domain feeds, malware samples, data formats, frameworks, tools and research.

View on GitHub
Stars
10,747
Forks
1,894
Open issues
151
Last commit
5 months ago

What is it?

awesome-threat-intelligence is a curated list of resources for threat intelligence, the practice of collecting and analysing evidence about threats so that security teams can act on them. It is organised into sections for sources, formats, frameworks and platforms, tools, and research, standards and books.

The Sources section is the largest part of the list. It catalogues public and commercial feeds of malicious IP addresses, domains, URLs, file hashes and SSL certificates, along with malware sample repositories, Yara rule collections, phishing feeds and passive DNS services. Many entries note whether they are free, require registration or have licensing limits for commercial use.

The Formats section lists standardised schemas for sharing indicators of compromise and incident data, such as CAPEC, CybOX, IODEF and IDMEF. The list is aimed at security analysts, SOC and CSIRT teams, and researchers who need to find feeds or standards to feed into detection systems.

Key features

  • 01Catalogues threat feeds of malicious IPs, domains, URLs and file hashes.
  • 02Lists malware sample repositories and Yara rule collections.
  • 03Notes which sources are free, require registration or restrict commercial use.
  • 04Covers standard exchange formats such as STIX-related CybOX, IODEF and IDMEF.
  • 05Includes frameworks, platforms, tools and books for threat intelligence work.

Use cases

  • Finding free IP blocklists and IOC feeds to feed into a firewall or SIEM.
  • Locating malware samples and Yara rules for detection engineering.
  • Choosing a standard format for sharing incident data between CSIRT teams.
  • Building a reading list on threat intelligence research and methods.

Things to know

  • Some listed feeds require a license for commercial use or are limited to non-commercial use.

Topics

#threat-intelligence#security#ioc#malware#awesome-list#siem#yara#awesome#hacktoberfest

FAQ

What is awesome-threat-intelligence?
A curated Awesome list of threat intelligence resources, covering IP and domain feeds, malware samples, data formats, frameworks, tools and research. awesome-threat-intelligence is a curated list of resources for threat intelligence, the practice of collecting and analysing evidence about threats so that security teams can act on them. It is organised into sections for sources, formats, frameworks and platforms, tools, and research, standards and books.
Is awesome-threat-intelligence free to use? What license does it have?
awesome-threat-intelligence is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is awesome-threat-intelligence still maintained?
Updated within 6 months. The last commit to awesome-threat-intelligence was on May 31, 2026.
What can I use awesome-threat-intelligence for?
Finding free IP blocklists and IOC feeds to feed into a firewall or SIEM. Locating malware samples and Yara rules for detection engineering. Choosing a standard format for sharing incident data between CSIRT teams. Building a reading list on threat intelligence research and methods.
Where can I get awesome-threat-intelligence?
The source code and installation instructions are on GitHub: https://github.com/hslatman/awesome-threat-intelligence

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects