hayder-rzaigui/cybernom-community — explained in plain English
Analysis updated 2026-05-18
Monitor RSS, JSON, website, and onion threat intelligence feeds in one place.
Track Microsoft 365 account security posture with read-only Graph API access.
Send severity-based security alerts to Discord, Slack, Telegram, or email.
Self-host a single-binary SOC monitoring platform with built-in login and roles.
| hayder-rzaigui/cybernom-community | 12vault/ravel | alexremn/finalizer-doctor | |
|---|---|---|---|
| Stars | 3 | 3 | 3 |
| Language | Go | Go | Go |
| Setup difficulty | moderate | easy | easy |
| Complexity | 4/5 | 2/5 | 3/5 |
| Audience | ops devops | developer | ops devops |
Figures from each repo's GitHub metadata at analysis time.
Requires Go 1.22+, Postgres 16+, and running database migrations, or Docker Compose for an all-in-one deploy.
CyberNom Community Edition is a free, open source security monitoring platform written in Go, packaged as a single binary that only needs a Postgres database to run alongside it. It is aimed at security operations teams who currently have to stitch together several separate, often unfinished tools: something to read threat intelligence feeds, something to alert on keywords, something to check Microsoft 365 account security, and some way to log in and control access to all of it. The project combines two kinds of monitoring into one tool. On one side, it pulls in external threat intelligence from RSS and Atom feeds, generic JSON APIs, plain websites, and even .onion sites reached through Tor, then raises alerts when content matches literal or regex based keyword rules, with severity levels and tag filtering. On the other side, it checks the security posture of a Microsoft 365 account through Microsoft's Graph API, using strictly read only access so it cannot make changes to the account it is monitoring. Both sides sit behind proper built in authentication, using JWT tokens, bcrypt password hashing, and two user roles, admin and viewer, something the author says the underlying ideas it was built from originally lacked. Alerts can be pushed out to Discord, Slack, Telegram, or email, each with its own minimum severity setting, and the platform ships with a built in web dashboard showing a live updating list of alerts that can be filtered by severity and acknowledged with one click. It also supports exporting alerts and audit logs as CSV files and generating JSON summary reports. The README documents a specific threat model, treating every external feed as untrusted input and describing defenses against issues like unsafe regex patterns, missing authentication, and unwanted network requests triggered by redirects. Installation works either natively, by installing Go 1.22 or newer and a Postgres 16 or newer database, running provided database migration files, and building the binary directly, or through Docker Compose, which brings up Postgres, Tor, the CyberNom binary, and an nginx reverse proxy together with one command. This Community Edition is MIT licensed and fully functional on its own, the README also mentions a separate paid Enterprise edition that adds role based access control, forwarding to external security tools, and an encrypted secrets vault.
A self-hosted, single-binary security platform in Go that monitors threat intelligence feeds and Microsoft 365 posture with built-in authentication.
Mainly Go. The stack also includes Go, Postgres, Microsoft Graph.
Community Edition is MIT licensed and free to use, a separate paid Enterprise edition adds extra features.
Setup difficulty is rated moderate, with roughly 1h+ to a first successful run.
Mainly ops devops.
This repo across BitVibe Labs
double-check against the repo, no cap.