git404hub

what is cybernom-community fr?

hayder-rzaigui/cybernom-community — explained in plain English

Analysis updated 2026-05-18

3GoAudience · ops devopsComplexity · 4/5LicenseSetup · moderate

tl;dr

A self-hosted, single-binary security platform in Go that monitors threat intelligence feeds and Microsoft 365 posture with built-in authentication.

vibe map

mindmap
  root((CyberNom Community))
    What it does
      Ingests threat intel feeds
      Checks Microsoft 365 posture
      Alerts via regex keyword rules
    Tech stack
      Go
      Postgres
      Microsoft Graph API
      Tor
    Use cases
      Monitor RSS and onion threat feeds
      Watch M365 risky sign-ins
      Send alerts to Slack or Telegram
    Audience
      SOC teams
      Security engineers

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

what do people make with this?

VIBE 1

Monitor RSS, JSON, website, and onion threat intelligence feeds in one place.

VIBE 2

Track Microsoft 365 account security posture with read-only Graph API access.

VIBE 3

Send severity-based security alerts to Discord, Slack, Telegram, or email.

VIBE 4

Self-host a single-binary SOC monitoring platform with built-in login and roles.

what's the stack?

GoPostgresMicrosoft GraphTorDocker

how it stacks up fr

hayder-rzaigui/cybernom-community12vault/ravelalexremn/finalizer-doctor
Stars333
LanguageGoGoGo
Setup difficultymoderateeasyeasy
Complexity4/52/53/5
Audienceops devopsdeveloperops devops

Figures from each repo's GitHub metadata at analysis time.

how do i run it?

Difficulty · moderate time til it works · 1h+

Requires Go 1.22+, Postgres 16+, and running database migrations, or Docker Compose for an all-in-one deploy.

Community Edition is MIT licensed and free to use, a separate paid Enterprise edition adds extra features.

in plain english

CyberNom Community Edition is a free, open source security monitoring platform written in Go, packaged as a single binary that only needs a Postgres database to run alongside it. It is aimed at security operations teams who currently have to stitch together several separate, often unfinished tools: something to read threat intelligence feeds, something to alert on keywords, something to check Microsoft 365 account security, and some way to log in and control access to all of it. The project combines two kinds of monitoring into one tool. On one side, it pulls in external threat intelligence from RSS and Atom feeds, generic JSON APIs, plain websites, and even .onion sites reached through Tor, then raises alerts when content matches literal or regex based keyword rules, with severity levels and tag filtering. On the other side, it checks the security posture of a Microsoft 365 account through Microsoft's Graph API, using strictly read only access so it cannot make changes to the account it is monitoring. Both sides sit behind proper built in authentication, using JWT tokens, bcrypt password hashing, and two user roles, admin and viewer, something the author says the underlying ideas it was built from originally lacked. Alerts can be pushed out to Discord, Slack, Telegram, or email, each with its own minimum severity setting, and the platform ships with a built in web dashboard showing a live updating list of alerts that can be filtered by severity and acknowledged with one click. It also supports exporting alerts and audit logs as CSV files and generating JSON summary reports. The README documents a specific threat model, treating every external feed as untrusted input and describing defenses against issues like unsafe regex patterns, missing authentication, and unwanted network requests triggered by redirects. Installation works either natively, by installing Go 1.22 or newer and a Postgres 16 or newer database, running provided database migration files, and building the binary directly, or through Docker Compose, which brings up Postgres, Tor, the CyberNom binary, and an nginx reverse proxy together with one command. This Community Edition is MIT licensed and fully functional on its own, the README also mentions a separate paid Enterprise edition that adds role based access control, forwarding to external security tools, and an encrypted secrets vault.

prompts (copy fr)

prompt 1
Walk me through the native installation steps for CyberNom Community Edition using Go and Postgres.
prompt 2
Explain how CyberNom's read-only Microsoft Graph access is scoped to avoid write permissions.
prompt 3
Summarize the threat model this project defends against, based on its documentation.
prompt 4
Help me configure notification thresholds for Discord, Slack, and email alerts in CyberNom.

Frequently asked questions

what is cybernom-community fr?

A self-hosted, single-binary security platform in Go that monitors threat intelligence feeds and Microsoft 365 posture with built-in authentication.

What language is cybernom-community written in?

Mainly Go. The stack also includes Go, Postgres, Microsoft Graph.

What license does cybernom-community use?

Community Edition is MIT licensed and free to use, a separate paid Enterprise edition adds extra features.

How hard is cybernom-community to set up?

Setup difficulty is rated moderate, with roughly 1h+ to a first successful run.

Who is cybernom-community for?

Mainly ops devops.

peek the repo → explain another one

This repo across BitVibe Labs

double-check against the repo, no cap.