Public evidence for the 1200km security research ecosystem.

MISP Galaxy threat-actor record

A Cyber Av3ngers threat-actor update was accepted into the public MISP Galaxy repository.

Boundary: upstream merge evidence; no downstream deployment or usage claim.

Detection-engineering resource acceptance

Threat Matrix and the CTI Analyst Field Manual passed external review for an upstream detection-engineering resource list.

Boundary: curation evidence; not evidence of production SOC deployment.

AIDebug YARA-resource acceptance

AIDebug passed upstream review for inclusion in a public YARA resource collection.

Boundary: external curation only; not package-use or active-user evidence.

AdversaryGraph SOC-resource acceptance

AdversaryGraph passed upstream review for inclusion in a public SOC resource collection.

Boundary: third-party curation evidence; not a production-deployment claim.

AdversaryGraph AI CTI-resource acceptance

AdversaryGraph passed upstream review for inclusion in a public AI/GPT security resource collection.

Boundary: third-party curation evidence; not a production-deployment claim.

GitHub PR Review Signal

Accepted and pending upstream pull requests are tracked separately so open submissions are not presented as accepted validation.

• Merged external PRs8
• Open GitHub PRs5
• Closed unmerged GitHub PRs30

GitLab MR Review Signal

GitLab merge requests are included from authenticated GitLab data plus public MR verification for known upstream requests.

• Open GitLab MRs0
• Merged GitLab MRs0
• Closed GitLab MRs1

Portfolio Repository Signal

Public GitHub footprint at snapshot time, including source repositories and forked repositories.

• Public repositories82
• Source repositories45
• Forked repositories37
• Total stars across public repositories125
• Total forks across public repositories23

AdversaryGraph

Repository traction and release evidence for the self-hosted CTI platform.

• Stars / forks28 / 2
• Watchers28
• Open issues1
• Latest published releasev7.0.0
• Current source releasev7.0.0
• Last pushed2026-08-25

AIDebug

Repository traction and release evidence for the malware-analysis and reverse-engineering debugger.

• Stars / forks12 / 2
• Watchers12
• Open issues0
• Latest published releasev3.0.0
• Last pushed2026-08-13

Open PR Backlog Health

1 of 5 open GitHub PRs have no maintainer comments or reviews yet. 0 are draft PRs.

• Clean / mergeable
  No technical blocker detected by GitHub.3
• Unstable
  Usually branch protection, missing status context, or pending required checks.0
• Behind
  Source branch needs sync with the target branch.1
• Blocked
  Repository rules block merge until a required condition is satisfied.0
• Unknown
  GitHub did not expose a stable mergeability result at snapshot time.1

Main reason for the backlog: external maintainer review latency. Actionable technical items at this snapshot: 1 behind, 0 blocked, 0 unstable.

Top Starred Public Repositories

Highest-star public repositories visible under the GitHub account at snapshot time.

• Unpacker
  source repository30 stars / 7 forks
• adversarygraph
  source repository28 stars / 2 forks
• AIDebug
  source repository12 stars / 2 forks
• AI-PT-Lab
  source repository11 stars / 1 fork
• String-Analyzer
  source repository7 stars / 1 fork

OpenCTI Platform

Connector submission to the OpenCTI upstream platform adding Anthropic AI-powered enrichment to the connector ecosystem. Under active maintainer review.

SigmaHQ Detection Rules

Sigma detection rule submission covering Deno child-process and non-mail IMAP activity, under maintainer review.

HexStrike Community Guide

Community guide index submission for the HexStrike AI documentation, under maintainer review.

LLM Security Lab List

Vulnerable AI Lab submission to a public LLM-security resource list, under maintainer review.

REMnux Salt States

AIDebug submission to REMnux's provisioning states, adding it alongside the distribution's other malware-analysis tooling.

AIDebug

AI-assisted malware reverse-engineering debugger with ATT&CK mappings, YARA seed rules, IOC export, JSON output, TUI workflow, and analyst reports.

AdversaryGraph

Self-hosted AI-assisted CTI platform for ATT&CK/ATLAS extraction, sector-aware actor relevance, IOC enrichment, MalwareGraph-backed malware analysis, asset attack surface mapping, APT comparison, D3.js Navigator workflows, STIX/OpenCTI export, and analyst-ready reporting.

Canonical Article Sources

Medium remains the public article source, while 1200km.com now provides internal navigation, Docusaurus pages, project pages, and ecosystem landing pages.

Core Article Clusters

CTI workflows, detection engineering, malware analysis, OpenCTI, cloud and Kubernetes security, AI-assisted security tooling, reproducible labs, and technical guides.

AIDebug

Maintainer-ready because it has a tagged release, PyPI package, deterministic tests, GitHub Actions CI, release notes, screenshots, safety model, sample evidence, packaging metadata, and a clear non-exploit malware-analysis scope.

AdversaryGraph

Maintainer-ready because the v7.0.0 source release is merged and CI-validated with the reproducible readiness gate, rollback guidance, source-backed workflows, case studies, governed Threat Hunting, Query Library, Unified RAG/MCP, asset exposure assessment, and SOC access groups. Attack Simulation and SIEM validation were introduced in the historical v5.0.0 line and remain part of the current platform. The latest published immutable GitHub release is v7.0.0, matching this source-release evidence.

1200km Labs

Maintainer-ready because the labs are framed as authorized, reproducible education and validation environments with clear deployment paths, screenshots, documentation, and CTI/detection context.

CTI Field Manual / Detection Work

Maintainer-ready because the work is organized around evidence handling, ATT&CK mapping, detection handoff, reproducibility, Sigma/MISP-compatible contribution patterns, and analyst-facing documentation.