An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules.
Repository Index
47,133 repositories indexed
1–24 of 39 · Most stars
SQL powered operating system instrumentation, monitoring, and analytics.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Sysmon configuration file template with default high-quality event tracing
- sysmon
- threatintel
- threat-hunting
- sysinternals
Investigate malicious Windows logon by visualizing and analyzing Windows event log
- security
- dfir
- javascript
- visualization
StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
- security
- kinesis
- serverless
- terraform
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
🌐 The all-in-one tool, for keeping track of your domain name portfolio. Got domain names? Get Domain Locker!
- dashboard
- domain-investment
- domain-management
- monitoring
A utility to safely generate malicious network traffic patterns and evaluate controls.
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
- anti-crawling
- cloud-native
- crawler
- deception
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
🔐 An SSL library for configuring http client or server. Rich with features such as hot reloading ssl and trusting additional certificates during runtime, combining multiple keystores, loading pem files and os/jdk certificates, logging certificate information during ssl handshake, bypassing ssl configuration from other libraries and more
Raspberry PI-TIMOLO ( PI-TImelapse, MOtion, LOwLight ) uses RPI picamera and OpenCV for Remote Headless Security Monitoring using Motion Tracking, Rclone Auto Sync files with remote storage services. Auto Twilight Transitions and Low Light Camera Settings. Panoramic images using PanTiltHat and More. This project is featured on GitHub Awesome software.
- opencv
- pi-camera
- python
- lowlight
Framework for running BPF programs with rules on Linux as a daemon. Container aware.
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
- threat
- hunt
- red
- blue
Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
This library provides a set of F# helpers for string manipulations, logging, collection data structures, file operations, text processing, security, async, parsing, diagnostics, configuration files and Json serialization.
Passive DNS Capture and Monitoring Toolkit
- passivedns
- passive-dns
- dns-server
- dns
Linux Security and Monitoring Scripts
TranslatedPacket monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux
- packet-generator
- packet-analyzer
- network
- networking
Universal web application security sensor intended for real-time monitoring and defense.
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
Zero-code K8s sidecar for log sanitization. Detects secrets via Entropy Analysis, preserves JSON integrity, and redacts PII deterministically. 🛡️
- devsecops
- entropy
- gdpr
- golang
🔍 Function-level tracing tool for Seccomp profiling, with eBPF
- ebpf
- ebpf-programs
- golang
- seccomp