Malicious traffic detection system
Repository Index
86,576 visible repositories in the index
1–24 of 26 · Most stars
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- ai-security
- alert-triage
- cybersecurity
- detection-engineering
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
- sample-code
- cybersecurity
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Security sensor for realtime threat detection and protection
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- rita
- network-traffic
- threat
- scanning
The repository host gives no description.
A framework for secure and scalable network traffic analysis - https://netcap.io
- network
- security
- monitoring
- detection
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
tirreno is an open-source framework for in-house security. Event tracking, risk scoring and threat detection for your system.
- fraud-detection
- intelligence
- antispam
- fraud
Multi-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring, quarantine, and multi-channel alerting
- bash
- clamav
- inotify
- intrusion-detection
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
Detect deauthentication frames using an ESP8266
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Collection of example YARA-L rules for use within Google Security Operations
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
:mailbox: The Phishing Intelligence Engine - An Active Defense PowerShell Framework for Phishing Defense with Office 365
Open-source agentic security operations platform:
- agentic-security
- cyber-security
- cyber-threat-intelligence
- cybersecurity
Passive Network Audit Framework