Repository Index

SQL powered operating system instrumentation, monitoring, and analytics.

• security
• monitoring
• intrusion-detection
• sql

Daemon to ban hosts that cause multiple authentication errors

• linux
• macos
• security
• intrusion-prevention

Cloud Native Runtime Security

• cncf
• containers
• security
• falco

Malicious traffic detection system

• security
• malware
• intrusion-detection
• sensor

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis

The Hunting ELK

• hunting
• elasticsearch
• kibana
• logstash

Rapidly Search and Hunt through Windows Forensic Artefacts

• attack
• rust
• security
• threat-hunting

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

• dfir
• threat
• hunting
• windows

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• network-security
• pcap
• security
• arkime

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

• encryption-server
• encryption
• crypto
• cryptography

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

Detect deauthentication frames using an ESP8266

• arduino
• esp8266
• deauth
• attack

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.

• cybersecurity
• d3js
• electron
• fastapi

teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.

• ids
• teler
• waf
• teler-ids

Respounder detects presence of responder in the network.

• responder
• golang
• network-security-monitoring
• network-security

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

• linux
• security
• kernel
• rootkit

🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.

• ai-security
• cybersecurity
• ids
• iot-security

Google Summer of Code 2012 project, supported by The Honeynet Project organization.

Real-time network traffic analysis in your terminal.

• cli
• ddos
• ddos-detection
• go

Sigma Queries turned into KQL for Defender using pysigma - Automated

• detection-engineering
• kql
• microsoftsentinel
• mitre-attack

TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel

• cybersecurity
• detection-engineering
• devops
• kql

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata