Daemon to ban hosts that cause multiple authentication errors
Repository Index
47,133 repositories indexed
1–17 of 17 · Most stars
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- ai-security
- alert-triage
- cybersecurity
- detection-engineering
eBPF-based Security Observability and Runtime Enforcement
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
A Suricata Docker image.
- suricata
- ids
- nsm
- docker
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans
- crowdsec
- intrusion-detection
- intrusion-detection-system
- intrusion-prevention
analyze a web-based network traffic 🕶 to detect central command and control servers
- squid
- network-traffic
- proxy-server
- incident-response
eBPF Security Monitoring and Sandboxing Agent Based on Aya
Local-LLM alert triage for self-hosted SOCs.