Repository Index

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

• security
• compliance
• log-analysis
• vulnerability-detection

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

• ai-security
• alert-triage
• cybersecurity
• detection-engineering

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

• hids
• security
• pci-dss
• nist800-53

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis

Rapidly Search and Hunt through Windows Forensic Artefacts

• attack
• rust
• security
• threat-hunting

Splunk Security Content

• splunk
• detection
• engineering
• responses

Elastic Security detection content for Endpoint

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

• github-actions
• actions
• supply-chain-security
• hardening

Detect deauthentication frames using an ESP8266

• arduino
• esp8266
• deauth
• attack

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.

• ids
• teler
• waf
• teler-ids

Universal web application security sensor intended for real-time monitoring and defense.

Splunk code (SPL) for serious threat hunters and detection engineers.

• splunk
• threat-hunting
• use-case
• siem

Suricata rules for network anomaly detection

• suricata-rule
• suricata
• ids
• nsm

:mailbox: The Phishing Intelligence Engine - An Active Defense PowerShell Framework for Phishing Defense with Office 365

🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.

• ai-security
• cybersecurity
• ids
• iot-security

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata

Sigma Queries turned into SPL for Splunk Enterprise and Enterprise Security using pysigma - Automated