SQL powered operating system instrumentation, monitoring, and analytics.
Repository Index
59,132 visible repositories in the index
1–24 of 26 · Most stars
Daemon to ban hosts that cause multiple authentication errors
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
- security
- compliance
- log-analysis
- vulnerability-detection
Main Sigma Rule Repository
- security
- monitoring
- siem
- logging
Malicious traffic detection system
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.
- security
- ids
- ips
- nsm
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
- case-management
- cyber-security
- endpoint-security
- information-security
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
BlockBlock provides continual protection by monitoring persistence locations.
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Linux Security and Monitoring Scripts
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
Universal web application security sensor intended for real-time monitoring and defense.
Suricata rules for network anomaly detection
- suricata-rule
- suricata
- ids
- nsm
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
A process monitoring tool that tries to detect exploitation
eBPF Security Monitoring and Sandboxing Agent Based on Aya
Advanced Phishing Protection: Suricata rulesets open and free
- anti-phishing
- antiphishing
- openphish
- phishing
Real-time network traffic analysis in your terminal.
- cli
- ddos
- ddos-detection
- go