Daemon to ban hosts that cause multiple authentication errors
Repository Index
47,133 repositories indexed
1–24 of 33 · Most stars
Main Sigma Rule Repository
- security
- monitoring
- siem
- logging
Malicious traffic detection system
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- ai-security
- alert-triage
- cybersecurity
- detection-engineering
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
The Hunting ELK
- hunting
- elasticsearch
- kibana
- logstash
The repository host gives no description.
- threat-detection
- threat-hunting
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Splunk Security Content
- splunk
- detection
- engineering
- responses
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
- encryption-server
- encryption
- crypto
- cryptography
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Laika BOSS: Object Scanning System
USB Keystroke Injection Protection
Collection of example YARA-L rules for use within Google Security Operations
Built-in Panther detection rules and policies
- security
- python
- cybersecurity
- siem
Linux Security and Monitoring Scripts
Quantum Insert
- quantum-insert
- python
- detection
- pcap
The OTX Suricata Rule Generator can be used to create the rules and configuration for Suricata to alert on indicators from your OTX account.
analyze a web-based network traffic 🕶 to detect central command and control servers
- squid
- network-traffic
- proxy-server
- incident-response
Intrusion Prevention System (IPS) for Secure Shell (SSH)