db.json

[
    {
      "description": "Threat Report Summarization",
      "tags": ["LLMs", "Threat Intel"],
      "link": "https://github.com/fr0gger/jupyter-collection/blob/main/Threat_Report_Summarization/Threat_Summarization_Few_shot_learning.ipynb",
      "authors": ["Thomas Roccia"]
    },
    {
      "description": "IOC Extractor",
      "tags": ["IOC", "MSTICpy", "Threat Intel"],
      "link": "https://github.com/fr0gger/jupyter-collection/blob/main/iocextractor/IOCExtractor.ipynb",
      "authors": ["Thomas Roccia"]
    },
    {
      "description": "MSTICpy VirusTotal Lookup",
      "tags": ["MSTICpy", "VirusTotal", "Enrichment", "IOC"],
      "link": "https://github.com/microsoft/msticpy/blob/main/docs/notebooks/VTLookupV3.ipynb",
      "authors": ["Ian Helen","Pete Bryan"]
    },
    {
      "description": "BloodHound Explore Kerberoastable Users",
      "tags": ["Bloodhound", "Data Analysis", "Kerberoast"],
      "link": "https://github.com/OTRF/infosec-jupyter-book/blob/master/docs/use-cases/data-analysis/02_bloodhound_explore_kerberoastable_users.ipynb",
      "authors": ["Roberto Rodriguez"]
    },
    {
      "description": "Kusto Analysis with MSTICpy",
      "tags": ["Kusto", "MSTICpy", "Data Analysis", "Threat Hunting"],
      "link": "https://github.com/microsoft/msticpy/blob/main/docs/notebooks/Kusto-Analysis.ipynb",
      "authors": ["Ian Helen"]
    },
    {
      "description": "Pivot function with MSTICpy",
      "tags": ["Pivot", "MSTICpy", "Enrichment", "Threat Hunting"],
      "link": "https://github.com/microsoft/msticpy/blob/main/docs/notebooks/PivotFunctions-Introduction.ipynb",
      "authors": ["Ian Helen", "Pete Bryan"]
    },
    {
      "description": "Guardians of Identity: OKTA's Underworld",
      "tags": ["OKTA", "IAM", "Threat Hunting", "Jupyterthon"],
      "link": "https://github.com/kaiiyer/okta-threat-hunting/blob/main/Guardians_of_Identity.ipynb",
      "authors": ["Kai Iyer"]
    },
    {
      "description": "I-SooN Data Leak Analysis using OCR and GenAI",
      "tags": ["LLMs", "Threat Intel", "OCR", "I-Soon"],
      "link": "https://github.com/fr0gger/jupyter-collection/blob/main/ISOON_DataLeak_OCR_GenAI/ISOON_ChinLeaks.ipynb",
      "authors": ["Thomas Roccia"]
    },
    {
      "description": "Ransomware Report Usecases1",
      "tags": ["Ransomware", "Threat Intel", "VirusTotal"],
      "link": "https://github.com/VirusTotal/vt-py/blob/master/examples/jupyter/ransomware_report_usecases1.ipynb",
      "authors": ["Google"]
    },
    {
      "description": "Multicloud Threat Hunting",
      "tags": ["Threat Hunting","Multi Cloud"],
      "link": "https://github.com/4R9UN/Notebooks/blob/main/Multi%20cloud%20Threat%20Hunting.ipynb",
      "authors": ["Arjun Trivedi"]
    },
    {
      "description": "IOC Hunting and Threat Analysis",
      "tags": ["Threat Hunting","Threat Intel","Threat Analysis"],
      "link": "https://github.com/4R9UN/Notebooks/blob/main/IOC%20Analysis.ipynb",
      "authors": ["Arjun Trivedi"]
    },
    {
        "description": "Query Timesketch for threat intelligence and report sightings in MISP and Mattermost",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "timesketch",
            "forensic",
            "monitoring",
            "detection",
            "sighting"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_timesketch_search_query_sightings.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Create a custom MISP warninglist",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "warninglist",
            "hunting"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_create_custom_MISP_warninglist.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Using timestamps in MISP",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "timestamp",
            "export"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_using_timestamps_in_MISP.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Curation: disable decayed indicators",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "curation",
            "workflow",
            "todo",
            "qa",
            "quality",
            "audit",
            "decaying",
            "indicators",
            "lifecycle"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_curate_disable_decayed_indicators.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Retroscan with a MISP warninglist",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "warninglist",
            "hunting",
            "false-positives",
            "indicator-quality",
            "curation"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_retroscan_with_MISP_warninglist.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Query CVE information",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "cve",
            "vulnerability",
            "exploits"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_query_cve_information.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Create a MISP event from Microsoft Sentinel security incidents",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "sentinel",
            "siem",
            "monitoring",
            "detection",
            "microsoft"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_event_from_sentinel_incidents.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Malware triage with MISP",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "malware",
            "triage",
            "incidentresponse",
            "ir",
            "dfir"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_malware_triage.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Query hash information",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "hash",
            "reputation",
            "abuse",
            "sample",
            "file",
            "malware"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_query_hash_information.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Query IP reputation",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "ip",
            "reputation",
            "abuse",
            "whois"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_query_ip_reputation.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Malware triage with MISP - Dynamic malware analysis",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "malware",
            "triage",
            "sandbox",
            "incidentresponse",
            "ir",
            "dfir"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_malware_triage_upload_sample.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Query URL reputation",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "url",
            "reputation",
            "phishing"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_query_url_reputation.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Query for inconsistencies in MISP events",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "distribution",
            "data protection",
            "curation",
            "inconsistencies",
            "qa",
            "quality",
            "audit"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_query_for_inconsistencies_misp_events.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Threat Actor profiling",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "mitre",
            "actor",
            "intrusion-set",
            "galaxies",
            "clusters",
            "contextualisation"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_threat_actor_profiling.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Curate MISP events",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "curation",
            "workflow",
            "todo",
            "qa",
            "quality",
            "audit"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_curate_misp_events.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Provision users and organisations",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "users",
            "organisations",
            "training",
            "provisioning"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_provision_users_organisations.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Create MISP objects and relationships",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "objects",
            "context"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_create_MISP_objects_and_relationship.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Bulk delete MISP events",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "delete",
            "clean",
            "curation"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_bulk_delete_events.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "JARM fingerprint investigations with Censys, Shodan and MISP",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "jarm",
            "fingerprint",
            "tls",
            "certificate",
            "censys",
            "shodan",
            "investigation",
            "infrastructure"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_jarm_verification.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Query domain reputation",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "domain",
            "reputation"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_query_domain_reputation.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Query Elasticsearch for threat intelligence and report sightings in MISP and Mattermost",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "elastic",
            "elasticsearch",
            "monitoring",
            "detection",
            "sighting"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_elasticsearch_matches_sightings.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Geolocate IP addresses and calculate distance",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "geolocation",
            "fingerprint",
            "geoint",
            "mmdb",
            "infrastructure"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_geolocate_ip_and_calc_distance.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Playbook title",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "tags"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_skeleton.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "Create or update a MISP event with information from a phishing incident with a link",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "phishing"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_create_or_update_a_MISP_event_with_information_from_a_phishing_incident_with_a_link.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "URL remediation",
        "tags": [
            "misp",
            "playbook",
            "Threat Intel",
            "IOC",
            "url",
            "remediation",
            "phishing"
        ],
        "link": "https://github.com/MISP/misp-playbooks/blob/main//misp-playbooks/pb_url_remediation.ipynb",
        "authors": [
            "Koen Van Impe"
        ]
    },
    {
        "description": "RAG ATT&CK",
        "tags": [
            "rag",
            "llm",
            "threat intel",
            "ATT&CK"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/RAG_ATT%26CK/RAG_ATT%26CK.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "ELK Threat Hunting",
        "tags": [
            "ELK",
            "threat hunting",
            "malware",
            "IOC"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/ELK_Threat_Hunting/ELK_Threat_Hunting.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "Conti Leaks Analysis",
        "tags": [
            "conti leaks",
            "threat intel",
            "leaks",
            "ransomware"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/Conti_Leaks_Analysis/Conti_Leaks_Notebook_TR.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "Malware String Similarity",
        "tags": [
            "malware",
            "threat intel",
            "jaccard",
            "iocs"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/strings_similarity/Strings_Extraction.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "10 Python Lib for Malware Analysis and Reverse Engineering",
        "tags": [
            "malware",
            "reverse Engineering",
            "yara",
            "iocs"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/10_pythonlib_for_RE/10_Python_Lib_for_Re.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "Pulsedive Lookup using MSTICpy",
        "tags": [
            "malware",
            "pulsedive",
            "Threat Intel",
            "iocs"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/pulsedive_lookup/PulsediveLookup.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "Malware Bazaar Lookup using MSTICpy",
        "tags": [
            "malware",
            "malware bazaar",
            "Threat Intel",
            "iocs"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/mblookup/MBLookup.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "VirusTotal Domain Hunting",
        "tags": [
            "malware",
            "virustotal",
            "Threat Intel",
            "iocs",
            "domain"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/vt_domain_hunting/VT_Domain_hunting.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "VirusTotal Domain Hunting",
        "tags": [
            "malware",
            "virustotal",
            "Threat Intel",
            "iocs",
            "domain"
        ],
        "link": "https://github.com/fr0gger/jupyter-collection/blob/main/vt_domain_hunting/VT_Domain_hunting.ipynb",
        "authors": [
            "Thomas Roccia"
        ]
    },
    {
        "description": "Automated search for exploit information across various security resources using product names, versions, or CVE IDs.",
        "tags": [
            "Exploit Search", 
            "Threat Intelligence", 
            "Vulnerability Management"
        ],
        "link": "https://github.com/rezaduty/QueryExploit-Notebook/blob/main/QueryExploit.ipynb",
        "authors": [
            "Reza Rashidi(rezaduty)"
        ]
    }  
]