cisagov

Automation to assess the state of your M365 tenant against CISA's baselines

RedEye is a visual analytic tool supporting Red & Blue Team operations

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Logging Made Easy (LME) is a no cost, open source platform that centralizes log collection, enhances threat detection, and enables real-time alerting, helping small to medium-sized organizations...

Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.

log4j-scanner is a project derived from other members of the open-source community by CISA to help organizations identify potentially vulnerable web services affected by the log4j vulnerabilities.

A web application that assists network defenders, analysts, and researchers in the process of mapping adversary behaviors to the MITRE ATT&CK® framework.

A community sourced list of log4j-affected software

A DFIR tool written in Python.

A scalable file analysis and data generation platform that allows users to easily orchestrate arbitrary docker/vm/shell tools at scale.

Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s...

A repo to conduct vulnerability enrichment.

Scan domains and return data based on HTTPS best practices

External monitoring for organization assets

SCuBA Secure Configuration Baselines and assessment tool for Google Workspace

Official list of .gov domains and related data

A tool to recover from ESXiArgs ransomware

A set of guidelines and best practices for an awesome engineering team

A collection of Active Directory, phishing, mobile technology, system, service, web application, and wireless technology weaknesses that may be discovered during a penetration test.

Scan domains and return data based on trustworthy email best practices

CISA's catalog of bad practices that are exceptionally risky.

President's Cup Cybersecurity Competition Challenges

Industrial Control Systems Network Protocol Parsers

A site for CISA directives

Playbook-NG is a stateless web-based application used to match incident findings with countermeasures for adversary containment and eviction.

Snaffler reimplementation in Python - https://github.com/SnaffCon/Snaffler

Mirror of cisa.gov/kev data files

CISA CSAF Security Advisories

findCDN is a tool created to help accurately identify what CDN a domain is using.

Test a host for susceptibility to CVE-2019-19781

This is a repository of vendor-agnostic workflows provided for those interested in deploying Security Orchestration, Automation, and Response capabilities within their organizations.

A Django-based domain name registrar that interfaces with an EPP registry

Search a filesystem for indicators of compromise (IoC).

Ludus is a system to build easy to use cyber environments, or "ranges" for testing and development.

An Ansible role for installing Cobalt Strike.

CISA is hiring! We’re looking for candidates passionate about our mission to lead the national effort to understand and manage cyber and physical risk to our critical infrastructure.

CISA's space for collaboration on the Cybersecurity Performance Goals.

Docker container with a postfix server designed for use during phishing campaigns

The PNT Integrity Library provides users a method to verify the integrity of the received GPS data and ranging signals, thereby improving resiliency against potential GPS signal loss.

Docker container for the gophish phishing framework.