Gjallarhorn Community
The Blue Team platform AllSafe uses in production. Now in your hands.
᚛ Why it’s called Gjallarhorn
In Norse mythology, Gjallarhorn is Heimdall’s horn – the guardian who never sleeps, the sentinel of Bifrost. It rests hidden beneath the root of the world tree, beside Mimir’s well, where the wisdom of all ages lies. When the threat no one else sees draws near, Heimdall blows the Gjallarhorn. Its sound crosses the nine worlds. No one can ignore it.
That’s how a Blue Team analyst with the right tools works: they don’t react to noise – they identify the real threat before anyone else sees it, and when they act, the entire team listens.
“Heimdall sees a hundred leagues away, by day and by night. He hears the grass growing in the field.”
– Prose Edda, Snorri Sturluson
Security is stronger when built as a community
Code you can audit
You don’t blindly trust any security tool – and you shouldn’t. Every line of Gjallarhorn Community is available for you to review, audit, and understand exactly what it does and why.
Adapted to your environment
Every organization faces different threats. With the code in your hands you can add your own intelligence sources, integrate tools from your stack, and extend Gjallarhorn in the direction your team needs.
Built together
The best security tools in history were born from shared knowledge. Every contribution improves a platform used by the entire community – including you.
Everything a Blue Team needs to get started
Gjallarhorn Community is not a stripped-down demo. It’s the real platform, with the core modules AllSafe uses every day on its own engagements.
IOC Investigation
Query IPs, domains, hashes and URLs against 15+ threat intelligence sources in real time. VirusTotal, AbuseIPDB, AlienVault OTX, URLScan and more. One place instead of a dozen tabs.
Malware Analysis
Static analysis of suspicious files without executing them. PE, scripts, documents, PDFs. Detection of ransomware signatures, Cobalt Strike beacons and common obfuscation techniques.
Email Forensics
Load a .eml and get SPF/DKIM/DMARC validation, IOC extraction, phishing and BEC detection, and the full message path trace across every relay server.
Case Management
Opening, assignment, severity and full lifecycle of every incident. TLP classification. Complete team history. Everything you need so no finding gets lost between Slack threads.
SOC Integrations
Connect TheHive, Wazuh, Velociraptor and OpenVAS/GVM. The tools you already use, talking to each other. No extra agents, no complex configuration.
Automatic Correlation
Wazuh fires an alert → Gjallarhorn investigates the IOCs → if the score exceeds the threshold, it opens the case in TheHive automatically. The analyst arrives to find the work already done.
The platform in screenshots
The main modules as they look in production.
Our commitment
Gjallarhorn Community will remain free and open source forever. This isn’t a marketing strategy – it’s a decision we made when we published the first commit and we won’t reverse it. The Pro version exists for organizations that need advanced features and dedicated support. The Community version exists because we believe tools that strengthen security should be within reach of every team, regardless of budget.
If you find a bug, open an issue. If you want to add something, send a pull request. If you built something interesting with Gjallarhorn, share it – those stories are what keeps an open source project alive.
Need more?
Gjallarhorn Pro adds additional integrations (Nessus, advanced bidirectional TheHive), a dynamic analysis sandbox, WAF management, a multi-client layer, dedicated AllSafe support and access to priority updates.