Open-Source Security Tools
Operator-built tools.
Free community editions.
Every tool is forged from real-world engagements and real gaps in the defender's toolkit. Community editions are open-source and free. Pro editions add enterprise capability for teams that need it.
CINDR Triage Engine
Automated static & behavioral malware analysis pipeline
A cloud-native malware analysis pipeline built on Azure Functions. Submit files via REST API and receive structured JSON reports covering file triage, string extraction, YARA matching, PE analysis, archive unpacking, macro extraction, obfuscation scoring, and heavy-tool behavioral analysis — all fully automated.
- HTTP intake API with multipart upload & deduplication
- Magic-byte triage across 25+ file types
- String extraction with IOC parsing (URLs, IPs, registry keys, Win32 APIs)
- YARA scanning with custom and community rulesets
- PE/ELF/Mach-O parsing: sections, imports, entropy, packer detection
- Archive unpacking with recursive analysis
- PDF JavaScript & attachment extraction; Office VBA/XLM macro analysis
- Obfuscation scoring for JS, PowerShell, Python, shell scripts
- Azure-native serverless deployment
- Heavy tool integration: capa, speakeasy, pestudio, detect-it-easy
- Managed cloud deployment with uptime SLA
- VirusTotal API reputation enrichment
- Custom YARA ruleset management & CI/CD pipeline
- Webhook delivery for analysis results
- Multi-tenant support with RBAC
- Analyst portal with submission history & report viewer
- Priority support & custom analysis module development
TTP Mapper
MITRE ATT&CK TTP correlation and threat actor identification
Rapidly correlate observed MITRE ATT&CK T-codes against known threat actor and malware TTPs. Input T-codes from your incident response engagement and instantly identify which threat actors and software are most likely responsible — ranked by overlap confidence.
- MITRE ATT&CK T-code input and parsing
- Threat actor and software TTP correlation
- Overlap scoring and confidence ranking
- Support for techniques, sub-techniques, and tactics
- Real-time analysis with instant results
- Export correlation results as JSON
- Historical campaign tracking and linkage
- Custom threat actor library management
- Confidence weighting customization
- API integration for automation
- Batch T-code processing
- Team-wide correlation history & audit logs
- Private intelligence feed integration
- Priority support & custom actor profile development
In Development
More tools in the pipeline.
Built from the same real-world gaps. Coming when they're ready.
Built by operators.
For operators.
Every CINDR tool is born from real engagements and real gaps. Have a capability need, a bug to report, or want to contribute? Get in touch.