Repository Index

Cloud Native Runtime Security

• cncf
• containers
• security
• falco

eBPF-based Security Observability and Runtime Enforcement

• bpf
• ebpf
• kernel
• kubernetes

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

• hids
• security
• pci-dss
• nist800-53

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

• dfir
• threat
• hunting
• windows

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• network-security
• pcap
• security
• arkime

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

• github-actions
• actions
• supply-chain-security
• hardening

A Simple Ransomware Vaccine

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.

• cybersecurity
• d3js
• electron
• fastapi

A Suricata Docker image.

• suricata
• ids
• nsm
• docker

Universal web application security sensor intended for real-time monitoring and defense.

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

• linux
• security
• kernel
• rootkit

eBPF Security Monitoring and Sandboxing Agent Based on Aya

• aya
• bpf
• ebpf
• security

Real-time network traffic analysis in your terminal.

• cli
• ddos
• ddos-detection
• go

Real-time monitoring and visualization of failed SSH login attempts on a Linux server.

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata