This project is a SIEM with SIRP and Threat Intel, all in one.

Malware repository component for samples & static configuration with REST API interface.

Client library for the mwdb service by CERT Polska.

Local plugin for MWDB that scans (re-)uploaded using ClamAV and Yara

Karton service that uploads analyzed artifacts and metadata to MWDB Core

Scalable Windows kernel driver vulnerability analysis pipeline — Karton + MWDB + Ghidra, with dashboards, alerting, and driver monitoring

DFIR-IRIS module ingesting malware into MWDB