Engineered for Blue Teams. Empowered for Purple Teams.
v3.2.1-stable · kernel 6.8 · SELinux enforcing
// About Griffin OS
Griffin OS isn't another Linux distro with tools bolted on. It's a purpose-built defensive operating system engineered from the ground up for cyber operations.
Custom-compiled kernel with grsecurity patches, ASLR, and stack protection. Every syscall audited.
Ship with 200+ defensive security tools pre-configured and battle-tested for production SOC environments.
Every tool runs in isolated containers with strict AppArmor profiles. Compromising one module can't pivot to others.
Built-in adversary simulation environment for detection validation, red-blue collaboration, and MITRE ATT&CK mapping.
// Core Modules
Each module is containerized, independently updatable, and hardened by default.
Centralized log management with real-time correlation, alerting, and compliance reporting.
Endpoint detection, extended telemetry, behavioral analysis, and automated response.
Multi-feed threat intel aggregation with IOC enrichment, STIX/TAXII support, and scoring.
Isolated detonation chamber for static and dynamic analysis with YARA rule generation.
Forensic imaging, memory analysis, timeline reconstruction, and chain-of-custody tools.
Attack simulation with detection validation, MITRE ATT&CK mapping, and gap analysis.
Real-time operational overview with alert triage, analyst workload, and KPI tracking.
Security orchestration with playbook automation, case management, and API integrations.
🔵 Blue Team
Purpose-built capabilities for SOC analysts, threat hunters, and incident responders.
2,847
Active Alerts
14.2K
Threats Blocked
3,291
Endpoints
4.2m
Mean TTR
[INFO] Correlation engine processed 1.2M events/sec
[WARN] Anomalous DNS query detected → 185.234.xx.xx
[CRIT] Lateral movement attempt blocked → Host-0847
[INFO] Automated containment initiated → Playbook IR-007
Multi-engine detection with ML-driven anomaly scoring, behavioral analytics, and real-time correlation.
Cross-source log normalization, CEF/LEEF parsing, and automated timeline reconstruction.
Automated incident response playbooks with containment, eradication, and recovery workflows.
Deep packet inspection, flow analysis, DNS monitoring, and lateral movement detection.
Continuous compliance monitoring for NIST, ISO 27001, SOC 2, PCI-DSS, and HIPAA frameworks.
🟣 Purple Team
Bridge the gap between offensive and defensive operations with collaborative tooling.
$ griffin-attack --technique T1059.001 --target lab-host-01
[*] Executing PowerShell execution chain...
[*] Payload delivered via macro-enabled document
[✓] Detection triggered: SIEM Rule #2847 - Suspicious PowerShell
[✓] EDR Alert: Behavioral detection - process injection
$ griffin-validate --coverage T1059
[✓] Detection coverage: 4/5 sub-techniques validated
[!] Gap identified: T1059.006 (Python) - No detection rule
Execute real-world attack chains in isolated environments to validate your defenses.
Automatically verify detection coverage against known TTPs and identify blind spots.
Full coverage matrix with heat maps showing detection gaps across all 14 tactics.
Shared workspace for adversary emulation, detection engineering, and gap analysis.
// Technical Specifications
Every layer of the stack has been hardened, audited, and tested against real-world threats.
Grsecurity patches, KASLR, SMEP/SMAP, and CFI enabled by default.
Mandatory access control with pre-built profiles for every bundled tool.
No implicit trust. Every connection authenticated, authorized, and encrypted.
Full-disk LUKS2 encryption with TPM2 binding and secure key escrow.
UEFI Secure Boot with custom MOK keys and signed kernel modules.
Every service runs in OCI containers with seccomp, namespaces, and cgroups v2.
// Download
Choose your edition. Verify the checksum. Boot and defend.
Full-featured for individuals and small teams. Open-source.
ISO Size: 4.2 GB
Download ISOCentralized management, RBAC, SIEM connectors, and SLA support.
ISO Size: 5.8 GB
Download ISOSHA256 Checksum (v3.2.1-stable):
a7f3b2c1d4e5f6a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2
$ sha256sum griffin-os-3.2.1-stable.iso