Repository Index

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis

Rapidly Search and Hunt through Windows Forensic Artefacts

• attack
• rust
• security
• threat-hunting

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

• dfir
• threat
• hunting
• windows

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

• aws
• cloud
• security
• big-data

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

• sigma
• python3
• evtx
• sigma-rules

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.

• cybersecurity
• d3js
• electron
• fastapi

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Universal web application security sensor intended for real-time monitoring and defense.

OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans

• crowdsec
• intrusion-detection
• intrusion-detection-system
• intrusion-prevention

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

Advanced Phishing Protection: Suricata rulesets open and free

• anti-phishing
• antiphishing
• openphish
• phishing

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata