Repository Index

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

• security
• compliance
• log-analysis
• vulnerability-detection

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

• dfir
• threat
• hunting
• windows

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

• encryption-server
• encryption
• crypto
• cryptography

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

BlockBlock provides continual protection by monitoring persistence locations.

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

• ebpf
• security
• linux-kernel
• linux-security-module

Quantum Insert

• quantum-insert
• python
• detection
• pcap

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

analyze a web-based network traffic 🕶 to detect central command and control servers

• squid
• network-traffic
• proxy-server
• incident-response

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata