Repository Index

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist

eBPF-based Security Observability and Runtime Enforcement

• bpf
• ebpf
• kernel
• kubernetes

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• network-security
• pcap
• security
• arkime

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

• encryption-server
• encryption
• crypto
• cryptography

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

USB Keystroke Injection Protection

Collection of example YARA-L rules for use within Google Security Operations

teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.

• ids
• teler
• waf
• teler-ids

BadActor.org An in-memory application driven jailer written in Go

Respounder detects presence of responder in the network.

• responder
• golang
• network-security-monitoring
• network-security

A process monitoring tool that tries to detect exploitation

Google Summer of Code 2012 project, supported by The Honeynet Project organization.

Real-time network traffic analysis in your terminal.

• cli
• ddos
• ddos-detection
• go

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata