Repository Index

SQL powered operating system instrumentation, monitoring, and analytics.

• security
• monitoring
• intrusion-detection
• sql

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

• security
• compliance
• log-analysis
• vulnerability-detection

Main Sigma Rule Repository

• security
• monitoring
• siem
• logging

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

• hids
• security
• pci-dss
• nist800-53

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

• dfir
• threat
• hunting
• windows

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• network-security
• pcap
• security
• arkime

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

The repository host gives no description.

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

Splunk Security Content

• splunk
• detection
• engineering
• responses

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

• aws
• cloud
• security
• big-data

Elastic Security detection content for Endpoint

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

• encryption-server
• encryption
• crypto
• cryptography

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.

• cybersecurity
• d3js
• electron
• fastapi

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Built-in Panther detection rules and policies

• security
• python
• cybersecurity
• siem

A Suricata Docker image.

• suricata
• ids
• nsm
• docker

Respounder detects presence of responder in the network.

• responder
• golang
• network-security-monitoring
• network-security

:mailbox: The Phishing Intelligence Engine - An Active Defense PowerShell Framework for Phishing Defense with Office 365

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

• linux
• security
• kernel
• rootkit

OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans

• crowdsec
• intrusion-detection
• intrusion-detection-system
• intrusion-prevention