Public evidence for the 1200km security research ecosystem.

MISP Galaxy threat-actor record

A Cyber Av3ngers threat-actor update was accepted into the public MISP Galaxy repository.

Boundary: upstream merge evidence; no downstream deployment or usage claim.

Detection-engineering resource acceptance

Threat Matrix and the CTI Analyst Field Manual passed external review for an upstream detection-engineering resource list.

Boundary: curation evidence; not evidence of production SOC deployment.

AIDebug YARA-resource acceptance

AIDebug passed upstream review for inclusion in a public YARA resource collection.

Boundary: external curation only; not package-use or active-user evidence.

AdversaryGraph SOC-resource acceptance

AdversaryGraph passed upstream review for inclusion in a public SOC resource collection.

Boundary: third-party curation evidence; not a production-deployment claim.

GitHub PR Review Signal

Accepted and pending upstream pull requests are tracked separately so open submissions are not presented as accepted validation.

• Merged external PRs8
• Open GitHub PRs30
• Closed unmerged GitHub PRs4

GitLab MR Review Signal

GitLab merge requests are included from authenticated GitLab data plus public MR verification for known upstream requests.

• Open GitLab MRs1
• Merged GitLab MRs0
• Closed GitLab MRs0

Portfolio Repository Signal

Public GitHub footprint at snapshot time, including source repositories and forked repositories.

• Public repositories82
• Source repositories45
• Forked repositories37
• Total stars across public repositories98
• Total forks across public repositories20

AdversaryGraph

Repository traction and release evidence for the self-hosted CTI platform.

• Stars / forks20 / 2
• Watchers20
• Open issues0
• Latest published releasev6.0.0
• Current source releasev6.5.0
• Last pushed2026-07-27

AIDebug

Repository traction and release evidence for the malware-analysis and reverse-engineering debugger.

• Stars / forks7 / 1
• Watchers7
• Open issues10
• Latest published releasev1.1.0
• Last pushed2026-07-18

Open PR Backlog Health

25 of 30 open GitHub PRs have no maintainer comments or reviews yet. 0 are draft PRs.

• Clean / mergeable
  No technical blocker detected by GitHub.24
• Unstable
  Usually branch protection, missing status context, or pending required checks.0
• Behind
  Source branch needs sync with the target branch.0
• Blocked
  Repository rules block merge until a required condition is satisfied.1
• Unknown
  GitHub did not expose a stable mergeability result at snapshot time.5

Main reason for the backlog: external maintainer review latency. Actionable technical items at this snapshot: 0 behind, 1 blocked, 0 unstable.

Top Starred Public Repositories

Highest-star public repositories visible under the GitHub account at snapshot time.

• Unpacker
  source repository21 stars / 6 forks
• adversarygraph
  source repository20 stars / 2 forks
• AI-PT-Lab
  source repository10 stars / 1 fork
• AIDebug
  source repository7 stars / 1 fork
• String-Analyzer
  source repository7 stars / 1 fork

AdversaryGraph / CTI / Detection

Submissions to threat intelligence, SOC, DFIR, MITRE ATT&CK, threat hunting, incident response, blue-team, and detection ecosystems. The MISP Galaxy and detection engineering submissions have moved to approved evidence.

AIDebug / Malware / Reverse Engineering

Submissions for reverse engineering, Python security, malware analysis, MalwareGraph standalone packaging, and threat intelligence lists. The YARA submission has moved to approved evidence.

Lab Portfolio

Submissions to lab, vulnerable app, AI/LLM security, cloud security, mobile security, cyber range, blue-team, and detection collections.

AI Tooling / Guides

Submissions for AI-assisted offensive security, audit, cloud assessment, CTI MCP, field manual, and HexStrike guide material.

OpenCTI Platform

Connector submission to the OpenCTI upstream platform adding Anthropic AI-powered enrichment to the connector ecosystem.

AIDebug

AI-assisted malware reverse-engineering debugger with ATT&CK mappings, YARA seed rules, IOC export, JSON output, TUI workflow, and analyst reports.

AdversaryGraph

Self-hosted AI-assisted CTI platform for ATT&CK/ATLAS extraction, sector-aware actor relevance, IOC enrichment, MalwareGraph-backed malware analysis, asset attack surface mapping, APT comparison, D3.js Navigator workflows, STIX/OpenCTI export, and analyst-ready reporting.

Canonical Article Sources

Medium remains the public article source, while 1200km.com now provides internal navigation, Docusaurus pages, project pages, and ecosystem landing pages.

Core Article Clusters

CTI workflows, detection engineering, malware analysis, OpenCTI, cloud and Kubernetes security, AI-assisted security tooling, reproducible labs, and technical guides.

AIDebug

Maintainer-ready because it has a tagged release, PyPI package, deterministic tests, GitHub Actions CI, release notes, screenshots, safety model, sample evidence, packaging metadata, and a clear non-exploit malware-analysis scope.

AdversaryGraph

Maintainer-ready because the v6.5.0 source release is merged and CI-validated with the reproducible readiness gate, rollback guidance, source-backed workflows, case studies, governed Threat Hunting, Query Library, Unified RAG/MCP, asset exposure assessment, and SOC access groups. Attack Simulation and SIEM validation were introduced in the historical v5.0.0 line and remain part of the current platform. The latest published immutable GitHub release is still v6.0.0, so this source-release evidence does not claim that a v6.5.0 tag or container family has already been published.

1200km Labs

Maintainer-ready because the labs are framed as authorized, reproducible education and validation environments with clear deployment paths, screenshots, documentation, and CTI/detection context.

CTI Field Manual / Detection Work

Maintainer-ready because the work is organized around evidence handling, ATT&CK mapping, detection handoff, reproducibility, Sigma/MISP-compatible contribution patterns, and analyst-facing documentation.