Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Repository Index
47,133 repositories indexed
1–20 of 20 · Most stars
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Cloud Native Runtime Security
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
Security sensor for realtime threat detection and protection
Elastic Security detection content for Endpoint
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
- encryption-server
- encryption
- crypto
- cryptography
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
BlockBlock provides continual protection by monitoring persistence locations.
USB Keystroke Injection Protection
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
A process monitoring tool that tries to detect exploitation
analyze a web-based network traffic 🕶 to detect central command and control servers
- squid
- network-traffic
- proxy-server
- incident-response
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
- detection
- splunk
- bpfdoor
- vulnerability
🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.
- ai-security
- cybersecurity
- ids
- iot-security
Advanced Phishing Protection: Suricata rulesets open and free
- anti-phishing
- antiphishing
- openphish
- phishing
Google Summer of Code 2012 project, supported by The Honeynet Project organization.