Ω / LINKS / METADATA ONLY

Security tool directory.

Reviewed project metadata and official links for red, blue, purple, and cross-team security work.

Evidence reviewed 2026-10-11Bounded seed · not an endorsement or a claim of global completeness

This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Apache Caldera (Incubating)

Adversary-emulation orchestration and ATT&CK-aligned exercise reporting.

Adversary emulation Detection and control validation Reporting and collaboration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM

Arkime

Scalable packet capture, indexed search, and network forensics.

DFIR and forensics Network security monitoring Threat hunting

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Atomic Red Team

Portable ATT&CK-aligned tests for telemetry and control validation.

Adversary emulation Detection and control validation Detection engineering

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Attack Flow

Attack-chain modeling, sequencing, visualization, and reporting.

ATT&CK mapping and coverage Reporting and collaboration Threat intelligence

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

AttackIQ Platform

Commercial adversarial exposure and security-control validation platform.

Detection and control validation Exposure validation and BAS Reporting and collaboration

Proprietary commercial subscription.
Reviewed Oct 12, 2026

BLUE TEAM

Autopsy

Desktop digital-forensics case analysis and reporting platform.

Case management and reporting DFIR and forensics

Apache-2.0 for Autopsy code; bundled dependencies retain their licenses.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

AWS CloudSaga

AWS security-event simulation for alert validation and incident-response exercises.

Cloud security Detection and control validation Incident response

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

BadZure

Disposable Azure and Entra lab orchestration for attack-path and detection exercises.

Detection and control validation Identity security Security lab orchestration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

BloodHound Community Edition

Graph-based identity and attack-path analysis for offensive and defensive workflows.

Identity security Vulnerability assessment

Apache-2.0 unless a lower-level component license states otherwise.
Reviewed Oct 12, 2026

RED TEAM

Burp Suite Professional / Community Edition

Commercial and community web application testing workbench.

Application security

Proprietary PortSwigger terms; Community Edition has separate terms.
Reviewed Oct 12, 2026

BLUE TEAM

CAPE Sandbox

Isolated automated malware analysis and behavior reporting platform.

DFIR and forensics Malware analysis and reverse engineering Threat intelligence

GPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM · RED TEAM

Certipy

Active Directory Certificate Services assessment for offensive and defensive review.

Identity security Vulnerability assessment

MIT
Reviewed Oct 12, 2026

BLUE TEAM

Chainsaw

Windows forensic artifact search and Sigma-backed threat hunting.

Detection engineering DFIR and forensics Threat hunting

GPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Cymulate Exposure Validation

Commercial adversarial exposure and detection-validation platform.

Detection and control validation Exposure validation and BAS

Proprietary commercial subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

DefectDojo Community Edition

Application-security finding management, deduplication, and remediation workflow.

Application security Reporting and collaboration Vulnerability management

BSD-3-Clause for the open-source Community repository; commercial editions differ.
Reviewed Oct 12, 2026

BLUE TEAM

Dependency-Track

SBOM-driven software supply-chain and vulnerability management.

Software supply-chain security Vulnerability management

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

DeTT&CT

ATT&CK data-source, detection-strategy, and maturity mapping.

ATT&CK mapping and coverage Detection engineering Threat intelligence

GPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM

DFIR-IRIS

Collaborative incident-response case management and reporting.

Case management and reporting DFIR and forensics Incident response

LGPL-3.0
Reviewed Oct 12, 2026

RED TEAM

dnsx

DNS resolution and record enrichment for an authorized asset set.

Network assessment Reconnaissance and asset discovery

MIT
Reviewed Oct 12, 2026

CROSS-TEAM · RED TEAM

Dradis Community Edition

Collaborative assessment evidence and report management.

Reporting and collaboration

GPL-2.0 for Community Edition; Professional is commercial.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Falco Event Generator

Runtime event generation for Falco rule and throughput validation.

Detection and control validation Detection engineering

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · RED TEAM

Faraday

Multiuser finding normalization, remediation tracking, and reporting.

Reporting and collaboration Vulnerability management

GPL-3.0
Reviewed Oct 12, 2026

RED TEAM

feroxbuster

Recursive web content discovery for defined targets.

Application security Reconnaissance and asset discovery

MIT
Reviewed Oct 12, 2026

RED TEAM

ffuf

Web content and input-surface discovery for defined targets.

Application security Reconnaissance and asset discovery

MIT
Reviewed Oct 12, 2026