47,133 repositories indexed
25–48 of 78 · Most stars
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
Detect deauthentication frames using an ESP8266
A Simple Ransomware Vaccine
BlockBlock provides continual protection by monitoring persistence locations.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Laika BOSS: Object Scanning System
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
OpenSOC Apache Hadoop Code
USB Keystroke Injection Protection
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
Collection of example YARA-L rules for use within Google Security Operations
Built-in Panther detection rules and policies
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
A Suricata Docker image.
Linux Security and Monitoring Scripts
BadActor.org An in-memory application driven jailer written in Go
Respounder detects presence of responder in the network.
Universal web application security sensor intended for real-time monitoring and defense.
Splunk code (SPL) for serious threat hunters and detection engineers.
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities