Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Repository Index
47,133 repositories indexed
1–13 of 13 · Most stars
A repository of sysmon configuration modules
- sysmon
- dfir
- threat-hunting
- mitre-attack
Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)
Security sensor for realtime threat detection and protection
Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
Signature based honeypot detector tool written in Golang
- cyber-threat-intelligence
- deception-technology
- honeypot
- offen
A SSH Server in Go that logs username/password combos
Go library MalShare API
Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious
- appliance
- network-monitoring
- suricata
Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.