Repository Index

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

• network-security
• pcap
• security
• arkime

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

• encryption-server
• encryption
• crypto
• cryptography

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

• threat-hunting
• purpleteam
• python3
• windows-eventlog

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

• github-actions
• actions
• supply-chain-security
• hardening

A Suricata Docker image.

• suricata
• ids
• nsm
• docker

Suricata rules for network anomaly detection

• suricata-rule
• suricata
• ids
• nsm

The OTX Suricata Rule Generator can be used to create the rules and configuration for Suricata to alert on indicators from your OTX account.

OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans

• crowdsec
• intrusion-detection
• intrusion-detection-system
• intrusion-prevention

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

Advanced Phishing Protection: Suricata rulesets open and free

• anti-phishing
• antiphishing
• openphish
• phishing

Google Summer of Code 2012 project, supported by The Honeynet Project organization.

Local-LLM alert triage for self-hosted SOCs.

• homelab
• ids
• llm
• ollama

The repository host gives no description.

Real-time monitoring and visualization of failed SSH login attempts on a Linux server.

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata