Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
- security
- compliance
- log-analysis
- vulnerability-detection
Repository Index
60,121 visible repositories in the index
1–21 of 21 · Most stars
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- ai-security
- alert-triage
- cybersecurity
- detection-engineering
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Security sensor for realtime threat detection and protection
Splunk Security Content
- splunk
- detection
- engineering
- responses
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
- network-security
- security
- arkime
- cybersecurity
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
Universal web application security sensor intended for real-time monitoring and defense.
Quantum Insert
- quantum-insert
- python
- detection
- pcap
:mailbox: The Phishing Intelligence Engine - An Active Defense PowerShell Framework for Phishing Defense with Office 365
OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans
- crowdsec
- intrusion-detection
- intrusion-detection-system
- intrusion-prevention
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
analyze a web-based network traffic 🕶 to detect central command and control servers
- squid
- network-traffic
- proxy-server
- incident-response
A tool to catch spoofed NBNS responses.