Ω / LINKS / METADATA ONLY

Blue team tools.

Reviewed project metadata and official links for red, blue, purple, and cross-team security work.

Evidence reviewed 2026-10-11Bounded seed · not an endorsement or a claim of global completeness

This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.

BLUE TEAM

IntelOwl

Indicator enrichment, analyzer orchestration, and threat-intelligence automation.

Malware analysis and reverse engineering Threat intelligence

AGPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Invoke-AtomicRedTeam

PowerShell orchestration for repeatable Atomic Red Team validation.

Adversary emulation Detection and control validation

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Mappings Editor

Creation and collaboration on custom security-capability mappings.

ATT&CK mapping and coverage Reporting and collaboration Security governance and mappings

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Mappings Explorer

Security-control-to-ATT&CK mapping and coverage exploration.

ATT&CK mapping and coverage Security governance and mappings

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

MISP

Threat-intelligence sharing and incident-context platform.

Incident response Malware analysis and reverse engineering Threat intelligence

AGPL-3.0 core; data libraries can have separate terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

MITRE ATT&CK Navigator

ATT&CK matrix annotation and coverage visualization.

ATT&CK mapping and coverage Reporting and collaboration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

MITRE ATT&CK Workbench

Local ATT&CK knowledge management, extensions, and sharing.

ATT&CK mapping and coverage Reporting and collaboration Threat intelligence

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

msInvader

Microsoft 365 and Azure simulation for telemetry and detection validation.

Adversary emulation Detection and control validation Identity security

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · RED TEAM

Nikto

Web-server exposure and configuration assessment tooling.

Application security Vulnerability assessment

GPL-3.0-only code; databases and LibWhisker have separate terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

OpenAEV

Adversarial exposure validation, atomic testing, and exercise reporting platform.

Detection and control validation Exposure validation and BAS Reporting and collaboration

Community Edition Apache-2.0; Enterprise Edition uses Filigran terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

OpenCTI

Threat-intelligence knowledge graph, collaboration, and reporting platform.

Reporting and collaboration Threat intelligence

Community Edition Apache-2.0; Enterprise Edition uses separate terms.
Reviewed Oct 12, 2026

BLUE TEAM

OpenSearch Security Analytics

OpenSearch-based security analytics, logging, detections, and hunting.

Detection engineering SIEM and logging Threat hunting

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · RED TEAM

OpenVAS Scanner

Network vulnerability scanning component of Greenbone Community Edition.

Vulnerability assessment

GPL-2.0 family with file-level qualifiers.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

osquery

SQL-like endpoint visibility for inventory, logging, and threat hunting.

Endpoint visibility and EDR SIEM and logging Threat hunting

BSD-style license in the canonical repository.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Picus Autonomous Exposure Validation Platform

Commercial adversarial exposure and attack-path validation platform.

Detection and control validation Exposure validation and BAS

Proprietary annual subscription.
Reviewed Oct 12, 2026

BLUE TEAM

Plaso

Forensic event extraction and super-timeline generation.

Case management and reporting DFIR and forensics

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Prowler

Cloud posture, identity, compliance, and exposure assessment.

Cloud security Vulnerability management

Apache-2.0 for the canonical open-source project; managed editions have separate terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

REMnux

Curated malware-analysis Linux distribution and tool environment.

DFIR and forensics Malware analysis and reverse engineering

Composite distribution; every included tool retains its own license.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

SafeBreach Validate

Commercial breach-and-attack simulation and detection validation platform.

Detection and control validation Exposure validation and BAS

Proprietary commercial subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · RED TEAM

ScoutSuite

Point-in-time multi-cloud configuration and exposure assessment.

Cloud security Vulnerability assessment

GPL-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

SCYTHE AEV Platform

Commercial adversary-emulation and detection-regression platform.

Adversary emulation Detection and control validation Exposure validation and BAS Reporting and collaboration

Proprietary commercial license scoped by deployment.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

SCYTHE Sigma Regression Testing

Detection-as-code regression testing and coverage reporting.

Detection and control validation Detection engineering

Detection Rule License 1.1
Reviewed Oct 12, 2026

BLUE TEAM

Security Onion

Security monitoring distribution combining logging, detections, network visibility, and case workflows.

Case management and reporting Detection engineering Network security monitoring SIEM and logging

Elastic License v2 for Security Onion and bundled Elastic components; other components retain their licenses.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

Sigma

Platform-neutral detection rule specification and reviewed rule corpus.

Detection engineering SIEM and logging Threat hunting

Detection Rule License 1.1 for rules; specification and logo are public domain.
Reviewed Oct 12, 2026