MISP is an open source threat intelligence platform where analysts log indicators and incidents, see how they connect, and share them with trusted organizations. Each case is an event holding attributes and structured objects such as files, network connections, and email messages, with Markdown reports beside the machine-readable data. A correlation engine links events that share values, including fuzzy-hash and CIDR matches, and warning lists flag benign values before they cause false positives. Taxonomies and galaxies tag events with TLP levels, threat actors, malware families, and MITRE ATT&CK techniques. Analysts explore relationships in an event graph and a correlation graph with a timeline, and build drag-and-drop dashboards with maps and ATT&CK heatmaps. Sharing groups control who sees which event, and instances synchronize with partner organizations with distribution settings down to a single attribute. Free-text, URL, bulk, and STIX imports fill the database, and exports reach Suricata, Snort, Zeek, OpenIOC, CSV, STIX 1 and 2, and RPZ zones. A REST API, the PyMISP library, expansion modules, and workflows enrich data and automate publishing. ZeroMQ and Kafka streams announce every change to connected tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Enterprise security stacks assume an enterprise budget; Wildbox assumes a server you already own. It runs your whole security operation as a set of cooperating services behind a single HTTPS gateway: threat intelligence collectors pull indicators from seven public feeds on a schedule, starting with abuse.ch's Feodo Tracker, and every indicator is searchable in one place. Fifty-two security tools sit behind one API, covering DNS, TLS, email security, headers, and port analysis. The cloud posture service runs 22 configuration checks against your live AWS accounts and keeps each scan's report, while the vulnerability service inventories your assets, prioritizes findings by risk, and tracks them through remediation with SLA checks and alert rules. When something needs doing, YAML playbooks execute response workflows as background jobs, and the agents service writes Claude-generated threat-enrichment reports for suspicious indicators when you give it an API key. An osquery-based sensor streams endpoint telemetry from your hosts into the platform, kept separate per team. Users, teams, roles, and scoped API keys live in the identity service, and the backends accept nothing that did not arrive through the gateway, so your security data never leaves hardware you control. Optional Compose profiles add n8n automation and Prometheus monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

AiSOC delivers an open-source AI Security Operations Center that unifies event ingestion, graph correlation, autonomous triage, and purple-team adversary emulation into a single self-hosted console. Security analysts triage alerts across an interactive Investigation Rail that visualizes six-event attack timelines, pivot-path entity graphs, and recommended containment steps. The underlying LangGraph agentic engine reasons over ingested telemetry, querying MITRE ATT&CK frameworks, CISA Known Exploited Vulnerabilities catalogs, and Shodan intelligence while recording every prompt, tool execution, and evidentiary citation in an immutable Investigation Ledger. Incident responders execute automated containment playbooks, including host network isolation, credential revocation in identity providers, and firewall blocklist updates with human-in-the-loop sign-offs. Threat hunters input plain-English hypotheses into the natural-language hunt workbench to generate and execute ES|QL, SPL, and KQL queries against historical telemetry stores. Platform operators connect over seventy vendor connectors spanning CrowdStrike, SentinelOne, Microsoft Defender, AWS Security Hub, Okta, and Cloudflare to normalize streaming events into Open Cybersecurity Schema Framework standards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Hunting for a suspicious file, process, or registry key across every endpoint becomes a single hunt in Velociraptor, an endpoint visibility and digital forensics platform. A web console sends tasks to clients on Windows, Linux, and macOS machines, which hold a persistent connection and run each task as soon as it is issued. A hunt runs a VQL artifact, one of more than 400 built in, across selected endpoints, picks up machines that reconnect later, and tracks which hosts have answered. Each hunt and collection opens into a notebook where markdown and live VQL cells group, filter, and timeline the results. A virtual file system browses a client's directories and fetches files through file, NTFS, and registry accessors, with hex and text viewers. Offline collectors bundle chosen artifacts into one binary that writes an optionally encrypted container for later import, suiting machines that never reach the server. Client event queries stream telemetry such as DNS lookups to the server, and server event queries can alert Slack, email, Elastic, or Splunk. Quarantine confines a host's network traffic to the Velociraptor server, and the Shell page runs commands on it. Sign-in works through Google, Azure, GitHub, OIDC, or SAML, with reader, analyst, investigator, and administrator roles. Responders reach for it during threat hunts, compromised host triage with KapeFiles targets, and dead disk image analysis. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Security teams drown in alerts that all demand the same twelve manual steps. Shuffle is an open-source security orchestration, automation, and response platform that turns those steps into visual workflows: an alert arrives from the SIEM, Shuffle enriches it against threat intelligence, opens the ticket, isolates the host, and messages the analyst, without anyone copying values between browser tabs. Analysts assemble workflows on a canvas from more than two thousand pre-built app integrations covering email, EDR, firewalls, ticketing, chat, and cloud services, and any tool with an OpenAPI description can be converted into a new app automatically, exported again, and reused outside Shuffle. Webhooks, schedules, and pipeline triggers start executions; custom Python covers the odd cases; conditional branches and sub-workflows keep one big playbook from becoming spaghetti. Multi-tenancy with sub-organisations, roles, single sign-on, and MFA fits managed security providers running one deployment for many customers, and execution workers can run on premises closer to the systems they touch. Community members publish workflows and apps to a marketplace, so a phishing triage playbook that works for one SOC can be running in another by lunchtime. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Protecting over 10,000 organizations worldwide with 16,000+ GitHub stars, Wazuh delivers enterprise-grade security operations through a fully open-source platform with zero feature gating. The unified XDR and SIEM solution deploys lightweight agents across Linux, Windows, macOS, Solaris, AIX, and HP-UX endpoints that stream security telemetry to a centralized cluster built on OpenSearch for indexing and the Wazuh Dashboard for visualization and management. Core capabilities include real-time file integrity monitoring with inotify-based detection and who-data attribution, automated vulnerability assessment that correlates software inventories against continuously updated CVE databases, Security Configuration Assessment against CIS benchmarks, rootkit detection, and log data analysis with a rules engine supporting over 3,000 built-in detection rules mapped to MITRE ATT&CK tactics and techniques. Wazuh monitors cloud infrastructure at the API level with native modules for AWS, Azure, and Google Cloud, detects container anomalies through Docker engine integration, and ingests third-party telemetry via syslog and REST APIs from sources like VirusTotal, TheHive, YARA, Suricata, and PagerDuty. Pre-built compliance dashboards and reports cover PCI DSS, HIPAA, NIST 800-53, GDPR, and TSC frameworks. Active response capabilities automatically trigger countermeasures including firewall rule updates, account lockouts, and endpoint isolation when threats are detected. The platform scales horizontally with multi-node clustering for high availability. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

SpiderFoot is an open-source OSINT automation platform, replacing hours of manual reconnaissance with automated intelligence gathering across more than 200 data collection modules. The platform accepts ten distinct target types including IP addresses, domains, hostnames, network subnets, ASNs, email addresses, phone numbers, usernames, person names, and Bitcoin addresses, then feeds them through a publisher-subscriber event bus where each module's findings trigger downstream analysis automatically. SpiderFoot queries Shodan, VirusTotal, HaveIBeenPwned, AlienVault OTX, Censys, crt.sh, WHOIS databases, social media platforms, breach databases, and dozens more sources, with most modules requiring no API keys and many offering free tiers for those that do. The YAML-configurable correlation engine applies 37 pre-defined rules to identify relationships between discovered data points, flagging patterns like shared infrastructure, credential exposure, and domain reputation anomalies. Results export in CSV, JSON, and GEXF graph formats for integration with external analysis tools. TOR integration enables dark web searching, and SpiderFoot can invoke external tools including DNSTwist, Whatweb, Nmap, and CMSeeK for deeper technical assessment. The embedded web server delivers an intuitive dashboard for scan management, data visualization, and result exploration alongside a full command-line interface for scripted automation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Flowsint turns scattered OSINT leads, like a domain, a username, an email, or a crypto wallet, into one interactive graph that you expand with a right click. Drop an entity on the canvas, run an enricher, and the results appear as new nodes with their relationships already drawn in. Over 30 built-in enrichers cover subdomain discovery, WHOIS and historical records, DNS and ASN lookups, IP geolocation, username searches with Maigret and Sherlock, breach checks for emails and phone numbers, Gravatar profiles, website crawling for contacts and tracking codes, and Ethereum wallet transactions and NFT transfers. Chain enrichers into flows so each output feeds the next step, then replay the same flow on any entity of that type. Missing a source? Write an enricher template in YAML, or describe the API in plain language and let the built-in AI draft it, with API keys kept in an encrypted vault instead of config files. Custom entity types, aliases, tags, JSON import and export, and basic role-based access control make it workable for small teams, and an n8n connector pipes findings into alerts and reports. Double-click the canvas to add items fast, or alt-drag between nodes to link them. Every graph stays on your own server, and no default accounts exist. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

VoidAccess is a self-hosted dark web OSINT platform that takes a single investigation question and returns a sourced report, a searchable relationship graph, and indicators you can load straight into your defenses. One query fans out in parallel to more than a dozen Tor search engines, code hosts, paste sites, security feeds, and curated onion seeds, then follows newly discovered onion links while mandatory safety gates drop prohibited queries, URLs, and content. A thirteen-step pipeline refines the question, collects across English, Russian, and Chinese sources, filters signal from duplicates and dead ends, enriches what survives, and extracts the entities that matter. It recognizes threat actors, ransomware groups, malware families, IP addresses, domains, onion addresses, file hashes, cryptocurrency wallets across seven chains, exposed credentials with secrets masked, messaging handles, CVEs, and MITRE ATT&CK techniques. Everything lands in an interactive graph with communities and infrastructure clusters, so you can start from one wallet or handle and walk the neighborhood it belongs to, cross-referenced against earlier investigations. Scheduled monitors watch for changes and send Telegram or email alerts when your targets move. Finished work exports as STIX 2.1, MISP events, Sigma and YARA rules, CSV, JSON, and bundled IOC packages, with multi-user access for a team. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

PRISM consolidates passive reconnaissance, credential leak detection, and network asset mapping into a unified operational dashboard to replace fragmented command-line security tools. Analysts can launch simultaneous multi-source investigations against domains, internet protocol addresses, email mailboxes, phone numbers, and online handles to uncover domain registrations, open network ports, cryptographic certificates, and historical web archives. The platform interrogates threat feeds and leak repositories to expose credential leaks, dark web mirrors, and email routing anomalies with automated SMTP mailbox verification. Cross-platform identity engines crawl thousands of social networks and public registries to correlate aliases, discover leaked commit identities, and trace digital footprints across the web. Discovered assets render into interactive entity relationship graphs alongside geographic internet protocol maps to help investigators visualize infrastructure clusters and ownership links. An automated operational security calculator evaluates exposure vulnerabilities across identity, web, and infrastructure vectors, producing an aggregated risk score with granular hardening recommendations. Scheduled watchlists continually monitor target infrastructure, dispatching webhook notifications to chat channels whenever new subdomains, ports, or credential leaks appear. Investigators can export comprehensive audit dossiers as self-contained HTML files, styled PDF documents, or structured spreadsheets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Trusted by over 60,000 organizations worldwide with more than 8,100 GitHub stars since 2010, Graylog has established itself as one of the fastest paths from raw log data to operational visibility, delivering centralized log management, security analytics, and compliance auditing through a purpose-built web interface with sub-second search at scale. The platform ingests logs from virtually any source via syslog, GELF, Beats, raw TCP/UDP, HTTP, CEF, IPFIX, and Netflow protocols, processing each message through configurable pipelines that parse fields, apply transformations, enrich events with GeoIP data from MaxMind or IPinfo lookup tables, and route messages to appropriate streams based on content rules. OpenSearch handles full-text indexing and storage with dynamic shard sizing that automatically calculates appropriate sizes from available node memory, while MongoDB stores configuration metadata including user accounts, roles, dashboards, alert rules, and pipeline definitions. The alerting system integrates with Slack, PagerDuty, and email with customizable notification templates and Replay Search links for immediate investigation context. Version 7.0 introduced MCP server integration for connecting preferred LLMs to perform AI-assisted log analysis and automation, while version 7.1 added Sigma detection rule import from private GitHub, GitLab, and Bitbucket repositories for detection-as-code workflows. The Sidecar agent management system centrally configures and deploys Filebeat, Winlogbeat, and nxlog collectors across infrastructure from the Graylog web interface. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. SSPL licensed.

Bots that knock on your server's login ports are always turned away by Knock-Knock, a multi-protocol honeypot that shows every attempt on a live dashboard. Honeypots answer on the standard ports for SSH, Telnet, FTP, RDP, SMB, SIP, HTTP, and SMTP, with MQTT, Node-RED, Modbus, S7, and SNMP as optional extras. Authentication is always rejected, so no bot ever gets a shell. Who is knocking? The live feed shows each attempt's country, username, password, ISP, IP, and protocol. From where? A 3D globe marks the origin in one of six styles, including an extruded country heat map. Trying what? Leaderboards rank countries, usernames, passwords, ISPs, and IP addresses, and a trivia panel explains why bots favor certain credentials. A protocol filter re-slices the feed, globe, and leaderboards together; SIP shows dialed numbers and toll-call destinations, and RDP shows hostnames and accounts. Too fast? Press the space bar to pause, right-click any knock for details, or switch on a virtual Geiger counter that clicks as attacks arrive. Want to fight back? Download hourly 30-day and 365-day blocklists with recipes for CSF, CrowdSec, ipset, nftables, and pfSense, or query the optional API for any IP, CIDR range, or ASN. Several honeypot servers can stream into one aggregated dashboard. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.