SQL powered operating system instrumentation, monitoring, and analytics.
Repository Index
47,133 repositories indexed
1–20 of 20 · Most stars
Daemon to ban hosts that cause multiple authentication errors
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Cloud Native Runtime Security
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
OpenSOC Apache Hadoop Code
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
A process monitoring tool that tries to detect exploitation
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
- detection
- splunk
- bpfdoor
- vulnerability
🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.
- ai-security
- cybersecurity
- ids
- iot-security
Real-time network traffic analysis in your terminal.
- cli
- ddos
- ddos-detection
- go
Sigma Queries turned into KQL for Defender using pysigma - Automated
- detection-engineering
- kql
- microsoftsentinel
- mitre-attack
TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel
- cybersecurity
- detection-engineering
- devops
- kql
Sigma Queries turned into SPL for Splunk Enterprise and Enterprise Security using pysigma - Automated