Daemon to ban hosts that cause multiple authentication errors
Repository Index
71,372 visible repositories in the index
1–24 of 43 · Most stars
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
- security
- compliance
- log-analysis
- vulnerability-detection
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Main Sigma Rule Repository
- security
- monitoring
- siem
- logging
Malicious traffic detection system
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
- case-management
- cyber-security
- endpoint-security
- information-security
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
- fastnetmon
- ddos
- sflow
- netflow
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
WIFI / LAN intruder detector. Check the devices connected and alert you with unknown devices. It also warns of the disconnection of "always connected" devices
- wifi
- lan
- ids
- scan
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Security sensor for realtime threat detection and protection
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- rita
- network-traffic
- threat
- scanning
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
- network-security
- security
- arkime
- cybersecurity