Daemon to ban hosts that cause multiple authentication errors
Repository Index
76,855 visible repositories in the index
1–24 of 38 · Most stars
Main Sigma Rule Repository
- security
- monitoring
- siem
- logging
Malicious traffic detection system
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- ai-security
- alert-triage
- cybersecurity
- detection-engineering
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
The Hunting ELK
- hunting
- elasticsearch
- kibana
- logstash
OWASP CRS (Official Repository)
- security
- ruleset
- owasp
- crs
The repository host gives no description.
- threat-detection
- threat-hunting
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
MUCH Improved version of the Python Chasing Your Tail Tool to help you determine if you're being followed
ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Splunk Security Content
- splunk
- detection
- engineering
- responses
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
- encryption-server
- encryption
- crypto
- cryptography
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Laika BOSS: Object Scanning System
USB Keystroke Injection Protection
Collection of example YARA-L rules for use within Google Security Operations
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
- network-security
- security
- arkime
- cybersecurity
Built-in Panther detection rules and policies
- security
- python
- cybersecurity
- siem
Linux Security and Monitoring Scripts