AIDebug accepted into REMnux.

MISP Galaxy threat-actor record

A Cyber Av3ngers threat-actor update was accepted into the public MISP Galaxy repository.

Boundary: upstream merge evidence; no downstream deployment or usage claim.

Detection-engineering resource acceptance

The upstream maintainers merged a resource-list contribution for ThreatMapper (the historical project name) and the CTI Analyst Field Manual. This records accepted curation, not an independent technical audit.

Boundary: curation evidence; not evidence of production SOC deployment.

AIDebug YARA-resource acceptance

The upstream maintainers merged AIDebug into a public YARA resource collection.

Boundary: external curation only; not package-use or active-user evidence.

AdversaryGraph SOC-resource acceptance

The upstream maintainers merged AdversaryGraph into a public SOC resource collection.

Boundary: third-party curation evidence; not a production-deployment claim.

AdversaryGraph AI CTI-resource acceptance

The upstream maintainers merged AdversaryGraph into a public AI/GPT security resource collection.

Boundary: third-party curation evidence; not a production-deployment claim.

GitHub PR Review Signal

Accepted and pending upstream pull requests are tracked separately so open submissions are not presented as accepted validation.

• Merged external PRs9
• Open GitHub PRs4
• Closed unmerged GitHub PRs30

GitLab MR Review Signal

Historical GitLab inventory from October 4, 2026; not revalidated in this review. Counts below are retained as historical records, not current status.

• Open GitLab MRs0
• Merged GitLab MRs0
• Closed GitLab MRs1

Portfolio Repository Signal

Public repositories visible in the public GitHub inventory checked 2026-10-28. Source and forked repositories are counted separately; private repositories are excluded.

• Public repositories80
• Source repositories43
• Forked repositories37
• Total stars across public repositories153
• Total forks across public repositories40

AdversaryGraph

Repository traction and release evidence for the self-hosted CTI platform.

• Stars / forks33 / 4
• Watch subscribers1
• Open issues (excluding PRs)0
• Open repository PRs2
• Latest published releasev8.1.2
• Retained documentation sourcev7.0.0
• Last pushed (UTC)2026-10-20

AIDebug

Repository traction and release evidence for the malware-analysis and reverse-engineering debugger.

• Stars / forks15 / 2
• Watch subscribers0
• Open issues (excluding PRs)0
• Open repository PRs5
• Latest published releasev3.0.0
• Last pushed (UTC)2026-10-24

Open PR Backlog Health

No non-author human comments or submitted reviews were found on the four open external PRs as checked October 28, 2026; bot reviews and author follow-ups are excluded. Labels or milestone changes can still indicate maintainer triage. None is a draft.

• Clean / mergeable
  No technical blocker detected by GitHub.2
• Unstable
  Usually branch protection, missing status context, or pending required checks.0
• Behind
  Source branch needs sync with the target branch.0
• Blocked
  Repository rules block merge until a required condition is satisfied.2
• Unknown
  GitHub did not expose a stable mergeability result at snapshot time.0

OpenCTI #6819 is blocked; Sigma #6065 is blocked; HexStrike #187 and the LLM-security list #226 are clean. These are GitHub technical states, not acceptance decisions or a finding about the cause of review delay.

Top Starred Public Repositories

Highest-star public repositories visible under the GitHub account at snapshot time.

• Unpacker
  source repository38 stars / 9 forks
• adversarygraph
  source repository33 stars / 4 forks
• AIDebug
  source repository15 stars / 2 forks
• AI-PT-Lab
  source repository12 stars / 1 forks
• String-Analyzer
  source repository7 stars / 1 forks

OpenCTI Platform

Connector submission to the OpenCTI upstream platform adding Anthropic AI-powered enrichment to the connector ecosystem. Opened 2026-06-27. A Filigran maintainer labelled it community and requested an automated Copilot review; no human review comments yet. GitHub last-updated timestamp: 2026-10-05; technical merge state: blocked.

SigmaHQ Detection Rules

Sigma detection rule submission covering Deno child-process and non-mail IMAP activity. Opened 2026-06-14; triaged by the repository's automation as Review Needed; no human review yet. On October 28 the technical merge state is blocked. Last updated October 24, 2026; the PR carries the Author Input Required and Review Needed labels and has no milestone. Labels and technical merge state are not acceptance.

HexStrike Community Guide

Community guide index submission for the HexStrike AI documentation. Opened 2026-05-15; no maintainer response yet.

LLM Security Lab List

Vulnerable AI Lab submission to a public LLM-security resource list. Opened 2026-06-14; only an automated CodeRabbit summary so far, no maintainer response.

AIDebug

AI-assisted malware reverse-engineering debugger with ATT&CK mappings, YARA seed rules, IOC export, JSON output, TUI workflow, and analyst reports.

AdversaryGraph

Self-hosted AI-assisted CTI platform for ATT&CK/ATLAS extraction, sector-aware actor relevance, IOC enrichment, MalwareGraph-backed malware analysis, asset attack surface mapping, APT comparison, D3.js Navigator workflows, STIX/OpenCTI export, and analyst-ready reporting.

More than GitHub release downloads

The attached v1.1.0 GitHub release files record 9 download events: 5 wheel downloads and 4 source-package downloads. This is a narrow, lifetime counter for those two assets, not total AIDebug downloads or installations.

REMnux provisioning installs the PyPI package through pip, so it does not need those GitHub release assets. The latest published AIDebug release is v3.0.0; the draft v3.1 release PR is not a published release.

What the evidence does not measure

Current AIDebug clone events are recorded above for a specific GitHub traffic window. No PyPI download count, active-user count, or REMnux usage total was available. The older aggregate-only portfolio history cannot be attributed to AIDebug.

Zero GitHub issues were found across open and closed states at this check. That is not evidence of zero users or zero bugs. Stars, forks, package downloads, clone events and feedback are separate signals; none alone establishes unique active users or production deployment.

Canonical Article Sources

Medium remains the public article source, while 1200km.com now provides internal navigation, Docusaurus pages, project pages, and ecosystem landing pages.

Core Article Clusters

CTI workflows, detection engineering, malware analysis, OpenCTI, cloud and Kubernetes security, AI-assisted security tooling, reproducible labs, and technical guides.

AIDebug

Maintainer-ready because it has a tagged release, PyPI package, deterministic tests, GitHub Actions CI, release notes, screenshots, safety model, sample evidence, packaging metadata, and a clear non-exploit malware-analysis scope.

AdversaryGraph

Maintainer-ready because the v7.0.0 source release is merged and CI-validated with the reproducible readiness gate, rollback guidance, source-backed workflows, case studies, governed Threat Hunting, Query Library, Unified RAG/MCP, asset exposure assessment, and SOC access groups. Attack Simulation and SIEM validation were introduced in the historical v5.0.0 line and remain part of the current platform. The latest published stable GitHub release is v8.1.2. That release is separate from the retained v7.0.0 source documentation and historical screenshot evidence.

1200km Labs

Maintainer-ready because the labs are framed as authorized, reproducible education and validation environments with clear deployment paths, screenshots, documentation, and CTI/detection context.

CTI Field Manual / Detection Work

Maintainer-ready because the work is organized around evidence handling, ATT&CK mapping, detection handoff, reproducibility, Sigma/MISP-compatible contribution patterns, and analyst-facing documentation.