Daemon to ban hosts that cause multiple authentication errors
Repository Index
57,138 visible repositories in the index
1–24 of 33 · Most stars
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
- security
- ids
- ips
- nsm
AIMSICD • Fight IMSI-Catcher, StingRay and silent SMS!
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
- case-management
- cyber-security
- endpoint-security
- information-security
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Detect deauthentication frames using an ESP8266
BlockBlock provides continual protection by monitoring persistence locations.
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Laika BOSS: Object Scanning System
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
- network-security
- security
- arkime
- cybersecurity
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
A Suricata Docker image.
- suricata
- ids
- nsm
- docker
BadActor.org An in-memory application driven jailer written in Go
Universal web application security sensor intended for real-time monitoring and defense.
Splunk code (SPL) for serious threat hunters and detection engineers.
- splunk
- threat-hunting
- use-case
- siem
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
Quantum Insert
- quantum-insert
- python
- detection
- pcap
Suricata rules for network anomaly detection
- suricata-rule
- suricata
- ids
- nsm
Open-source agentic security operations platform:
- agentic-security
- cyber-security
- cyber-threat-intelligence
- cybersecurity