Repository Index

SQL powered operating system instrumentation, monitoring, and analytics.

• security
• monitoring
• intrusion-detection
• sql

Daemon to ban hosts that cause multiple authentication errors

• linux
• macos
• security
• intrusion-prevention

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

• security
• compliance
• log-analysis
• vulnerability-detection

Main Sigma Rule Repository

• security
• monitoring
• siem
• logging

Cloud Native Runtime Security

• cncf
• containers
• security
• falco

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

• hids
• security
• pci-dss
• nist800-53

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• network-security
• pcap
• security
• arkime

Sysmon for Linux

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

• encryption-server
• encryption
• crypto
• cryptography

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

• github-actions
• actions
• supply-chain-security
• hardening

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.

• cybersecurity
• d3js
• electron
• fastapi

Laika BOSS: Object Scanning System

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Real-time network traffic analysis in your terminal.

• cli
• ddos
• ddos-detection
• go

Local-LLM alert triage for self-hosted SOCs.

• homelab
• ids
• llm
• ollama

Sigma Queries turned into KQL for Defender using pysigma - Automated

• detection-engineering
• kql
• microsoftsentinel
• mitre-attack

TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel

• cybersecurity
• detection-engineering
• devops
• kql