Daemon to ban hosts that cause multiple authentication errors
Repository Index
47,133 repositories indexed
1–24 of 29 · Most stars
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Cloud Native Runtime Security
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Security sensor for realtime threat detection and protection
Elastic Security detection content for Endpoint
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
- encryption-server
- encryption
- crypto
- cryptography
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
Detect deauthentication frames using an ESP8266
BlockBlock provides continual protection by monitoring persistence locations.
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
USB Keystroke Injection Protection
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
A process monitoring tool that tries to detect exploitation
OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans
- crowdsec
- intrusion-detection
- intrusion-detection-system
- intrusion-prevention
analyze a web-based network traffic 🕶 to detect central command and control servers
- squid
- network-traffic
- proxy-server
- incident-response
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
- detection
- splunk
- bpfdoor
- vulnerability
Intrusion Prevention System (IPS) for Secure Shell (SSH)