Repository Index

An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules.

• ai
• llm
• api
• chatbot

SQL powered operating system instrumentation, monitoring, and analytics.

• security
• monitoring
• intrusion-detection
• sql

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

• security
• compliance
• log-analysis
• vulnerability-detection

Sysmon configuration file template with default high-quality event tracing

• sysmon
• threatintel
• threat-hunting
• sysinternals

Investigate malicious Windows logon by visualizing and analyzing Windows event log

• security
• dfir
• javascript
• visualization

StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.

• security
• kinesis
• serverless
• terraform

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

• aws
• cloud
• security
• big-data

🌐 The all-in-one tool, for keeping track of your domain name portfolio. Got domain names? Get Domain Locker!

• dashboard
• domain-investment
• domain-management
• monitoring

Tenzir is the data pipeline engine for security teams.

• incident-response
• threathunting
• siem
• soc

🔐 An SSL library for configuring http client or server. Rich with features such as hot reloading ssl and trusting additional certificates during runtime, combining multiple keystores, loading pem files and os/jdk certificates, logging certificate information during ssl handshake, bypassing ssl configuration from other libraries and more

• tls
• ssl
• certificate
• keystore

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search

• security
• netsec
• suricata
• ids

Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.

• aws
• security
• monitoring
• automation

Open Source SIEM (Security Information and Event Management system).

• siem
• risk-management
• risk-assessment
• vulnerability-management

Apache Logfile Security Analyzer

CLI utility and Python module for analyzing log files and other data.

• log-analysis
• log-parser
• cli
• security

A Python library and command line tools to provide interactive log visualization.

• cybersecurity
• investigation
• malware-analysis
• malware-research

Cyber Defence Monitoring Course Suite :: Suricata, Arkime (and others in the past)

• moloch
• suricata
• monitoring
• nsm

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

eBPF Security Monitoring and Sandboxing Agent Based on Aya

• aya
• bpf
• ebpf
• security

Defensomania is a security monitoring and incident response card game.

• incident-response
• self-assessment
• incident-response-readiness
• educational-game

fast, extensible, versatile event router for Suricata's EVE-JSON format

• suricata
• eve
• json
• golang

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Local-first policy gateway for coding agents. Allow, review, or block MCP, shell, SQL, GitHub, and HTTP actions with scoped credentials and signed evidence.

• golang
• observability
• opentelemetry
• policy-engine

Tom's Honey Pot as seen in Applied Network Security Monitoring.