Daemon to ban hosts that cause multiple authentication errors
Repository Index
47,133 repositories indexed
1–24 of 25 · Most stars
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Main Sigma Rule Repository
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
The Hunting ELK
- hunting
- elasticsearch
- kibana
- logstash
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Security sensor for realtime threat detection and protection
Splunk Security Content
- splunk
- detection
- engineering
- responses
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
Detect deauthentication frames using an ESP8266
A Simple Ransomware Vaccine
Collection of example YARA-L rules for use within Google Security Operations
BadActor.org An in-memory application driven jailer written in Go
Universal web application security sensor intended for real-time monitoring and defense.
Splunk code (SPL) for serious threat hunters and detection engineers.
- splunk
- threat-hunting
- use-case
- siem
Anvilogic Forge
- detection
- detection-engineering
- threat-hunting
- snowflake
A process monitoring tool that tries to detect exploitation
OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans
- crowdsec
- intrusion-detection
- intrusion-detection-system
- intrusion-prevention
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
- detection
- splunk
- bpfdoor
- vulnerability
Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious
- appliance
- network-monitoring
- suricata