Ω / LINKS / METADATA ONLY

Security tool directory.

Reviewed project metadata and official links for red, blue, purple, and cross-team security work.

Evidence reviewed 2026-10-11Bounded seed · not an endorsement or a claim of global completeness

This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.

BLUE TEAM · CROSS-TEAM

Fleet

Endpoint visibility and device-management platform built around osquery.

Endpoint visibility and EDR Reporting and collaboration Vulnerability management

MIT core/free portions with separately licensed enterprise, documentation, and third-party components.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

Ghidra

Software reverse-engineering framework for malware and vulnerability research.

Malware analysis and reverse engineering Vulnerability assessment

Apache-2.0 core with GPL-3.0 support programs and separately licensed third-party components.
Reviewed Oct 12, 2026

BLUE TEAM

Greenbone Community Edition

Multi-component vulnerability-management stack and reporting workflow.

Reporting and collaboration Vulnerability management

Components have separate licenses; gvmd is AGPL-3.0-or-later.
Reviewed Oct 12, 2026

RED TEAM

httpx

HTTP endpoint probing and service metadata for an authorized asset set.

Network assessment Reconnaissance and asset discovery

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

IBM SimRun

Cloud attack simulation, log injection, and alert-matching validation.

Adversary emulation Cloud security Detection and control validation

Apache-2.0
Reviewed Oct 12, 2026

RED TEAM

Impacket

Protocol library and utilities for authorized Windows-network research.

Identity security Network assessment

Slightly modified Apache Software License, per upstream.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Infection Monkey

Adversary emulation and propagation-path validation for controlled environments.

Adversary emulation Detection and control validation Exposure validation and BAS

GPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM

IntelOwl

Indicator enrichment, analyzer orchestration, and threat-intelligence automation.

Malware analysis and reverse engineering Threat intelligence

AGPL-3.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

Invoke-AtomicRedTeam

PowerShell orchestration for repeatable Atomic Red Team validation.

Adversary emulation Detection and control validation

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Mappings Editor

Creation and collaboration on custom security-capability mappings.

ATT&CK mapping and coverage Reporting and collaboration Security governance and mappings

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM

Mappings Explorer

Security-control-to-ATT&CK mapping and coverage exploration.

ATT&CK mapping and coverage Security governance and mappings

Apache-2.0
Reviewed Oct 12, 2026

CROSS-TEAM · PURPLE TEAM · RED TEAM

Metasploit Framework

Modular framework for controlled validation and adversary emulation.

Adversary emulation Vulnerability assessment

3-Clause BSD for the framework; bundled dependencies have separate licenses.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

MISP

Threat-intelligence sharing and incident-context platform.

Incident response Malware analysis and reverse engineering Threat intelligence

AGPL-3.0 core; data libraries can have separate terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

MITRE ATT&CK Navigator

ATT&CK matrix annotation and coverage visualization.

ATT&CK mapping and coverage Reporting and collaboration

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

MITRE ATT&CK Workbench

Local ATT&CK knowledge management, extensions, and sharing.

ATT&CK mapping and coverage Reporting and collaboration Threat intelligence

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

msInvader

Microsoft 365 and Azure simulation for telemetry and detection validation.

Adversary emulation Detection and control validation Identity security

Apache-2.0
Reviewed Oct 12, 2026

RED TEAM

Naabu

Rate-controlled port discovery for defined assessment scopes.

Network assessment

MIT
Reviewed Oct 12, 2026

RED TEAM

NetExec

Network and directory assessment framework for authorized environments.

Identity security Network assessment

BSD-2-Clause
Reviewed Oct 12, 2026

BLUE TEAM · RED TEAM

Nikto

Web-server exposure and configuration assessment tooling.

Application security Vulnerability assessment

GPL-3.0-only code; databases and LibWhisker have separate terms.
Reviewed Oct 12, 2026

CROSS-TEAM · RED TEAM

Nmap

Network discovery and service identification for defined assessment scopes.

Network assessment

Nmap Public Source License 0.95; not a standard OSI license.
Reviewed Oct 12, 2026

PURPLE TEAM · RED TEAM

Nuclei

Template-based exposure validation after explicit scope and authorization.

Application security Detection and control validation Vulnerability assessment

MIT
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM · PURPLE TEAM · RED TEAM

OpenAEV

Adversarial exposure validation, atomic testing, and exercise reporting platform.

Detection and control validation Exposure validation and BAS Reporting and collaboration

Community Edition Apache-2.0; Enterprise Edition uses Filigran terms.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

OpenCTI

Threat-intelligence knowledge graph, collaboration, and reporting platform.

Reporting and collaboration Threat intelligence

Community Edition Apache-2.0; Enterprise Edition uses separate terms.
Reviewed Oct 12, 2026

BLUE TEAM

OpenSearch Security Analytics

OpenSearch-based security analytics, logging, detections, and hunting.

Detection engineering SIEM and logging Threat hunting

Apache-2.0
Reviewed Oct 12, 2026