Ω / LINKS / METADATA ONLY

Cross-team tools.

Reviewed project metadata and official links for red, blue, purple, and cross-team security work.

Evidence reviewed 2026-10-11Bounded seed · not an endorsement or a claim of global completeness

This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

msInvader

Microsoft 365 and Azure simulation for telemetry and detection validation.

Adversary emulation Detection and control validation Identity security

Apache-2.0
Reviewed Oct 12, 2026

CROSS-TEAM · RED TEAM

Nmap

Network discovery and service identification for defined assessment scopes.

Network assessment

Nmap Public Source License 0.95; not a standard OSI license.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

OpenAEV

Adversarial exposure validation, atomic testing, and exercise reporting platform.

Detection and control validation Exposure validation and BAS Reporting and collaboration

Community Edition Apache-2.0; Enterprise Edition uses Filigran terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

OpenCTI

Threat-intelligence knowledge graph, collaboration, and reporting platform.

Reporting and collaboration Threat intelligence

Community Edition Apache-2.0; Enterprise Edition uses separate terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

osquery

SQL-like endpoint visibility for inventory, logging, and threat hunting.

Endpoint visibility and EDR SIEM and logging Threat hunting

BSD-style license in the canonical repository.
Reviewed Oct 12, 2026

CROSS-TEAM · RED TEAM

OWASP Amass

Attack-surface and DNS asset discovery for explicitly scoped research.

Reconnaissance and asset discovery

Apache-2.0 for the main program; separately licensed subcomponents may apply.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Picus Autonomous Exposure Validation Platform

Commercial adversarial exposure and attack-path validation platform.

Detection and control validation Exposure validation and BAS

Proprietary annual subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Prowler

Cloud posture, identity, compliance, and exposure assessment.

Cloud security Vulnerability management

Apache-2.0 for the canonical open-source project; managed editions have separate terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

REMnux

Curated malware-analysis Linux distribution and tool environment.

DFIR and forensics Malware analysis and reverse engineering

Composite distribution; every included tool retains its own license.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

SafeBreach Validate

Commercial breach-and-attack simulation and detection validation platform.

Detection and control validation Exposure validation and BAS

Proprietary commercial subscription.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · RED TEAM

ScoutSuite

Point-in-time multi-cloud configuration and exposure assessment.

Cloud security Vulnerability assessment

GPL-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

SCYTHE AEV Platform

Commercial adversary-emulation and detection-regression platform.

Adversary emulation Detection and control validation Exposure validation and BAS Reporting and collaboration

Proprietary commercial license scoped by deployment.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

SCYTHE Sigma Regression Testing

Detection-as-code regression testing and coverage reporting.

Detection and control validation Detection engineering

Detection Rule License 1.1
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

Sigma

Platform-neutral detection rule specification and reviewed rule corpus.

Detection engineering SIEM and logging Threat hunting

Detection Rule License 1.1 for rules; specification and logo are public domain.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Splunk Attack Data

Curated attack telemetry for detection development and replay validation.

Detection and control validation Detection engineering

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Splunk Attack Range

Instrumented security lab orchestration and telemetry generation.

Detection and control validation Detection engineering Security lab orchestration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Stratus Red Team

Granular cloud adversary emulation for telemetry and detection validation.

Adversary emulation Cloud security Detection and control validation

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

VECTR

Purple-team exercise planning, test tracking, measurement, and reporting.

ATT&CK mapping and coverage Detection and control validation Reporting and collaboration

Custom VECTR terms/EULA; bundled Atomic Red material retains separate licensing.
Reviewed Oct 12, 2026

CROSS-TEAM · RED TEAM

Wapiti

Black-box web and API application security scanner.

Application security Vulnerability assessment

GPL-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

YARA-X

Pattern-matching engine for malware analysis, hunting, and detection engineering.

Detection engineering Malware analysis and reverse engineering Threat hunting

BSD-3-Clause
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

ZAP by Checkmarx

Intercepting proxy and web application security testing platform.

Application security Detection and control validation

Apache-2.0
Reviewed Oct 12, 2026