SQL powered operating system instrumentation, monitoring, and analytics.
Repository Index
55,140 visible repositories in the index
1–24 of 58 · Most stars
Daemon to ban hosts that cause multiple authentication errors
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
- security
- compliance
- log-analysis
- vulnerability-detection
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
Malicious traffic detection system
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- ai-security
- alert-triage
- cybersecurity
- detection-engineering
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
- security
- ids
- ips
- nsm
Rust tool to detect cell site simulators on an orbic mobile hotspot
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
The repository host gives no description.
- threat-detection
- threat-hunting
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Security sensor for realtime threat detection and protection
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Splunk Security Content
- splunk
- detection
- engineering
- responses
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Elastic Security detection content for Endpoint
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
- encryption-server
- encryption
- crypto
- cryptography
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.