OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
Repository Index
47,133 repositories indexed
1–13 of 13 · Most stars
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
- cybersecurity
- threat
- ioc
- malware
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
- anti-crawling
- cloud-native
- crawler
- deception
Aggregates security advisories from 10 international CERTs daily and provides an AI skill that cross-references alerts against your project's tech stack.
- cve
- security
- security-alerts
- vulnerability
The OTX Suricata Rule Generator can be used to create the rules and configuration for Suricata to alert on indicators from your OTX account.
ThreatTracker is a Python script designed to monitor and generate alerts on given sets of indicators of compromise (IOCs) indexed by a set of Google Custom Search Engines.
Create dataset for suricata with indicators of MISP instances and add sightings in MISP if an indicator of dataset generates an alert
Lightweight Docker monitoring dashboard with anomaly detection & Telegram alerts. One-liner install, zero config.
Local-LLM alert triage for self-hosted SOCs.