SQL powered operating system instrumentation, monitoring, and analytics.
Repository Index
58,136 visible repositories in the index
1–14 of 14 · Most stars
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
- ai-security
- alert-triage
- cybersecurity
- detection-engineering
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
- case-management
- cyber-security
- endpoint-security
- information-security
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
Security sensor for realtime threat detection and protection
The repository host gives no description.
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
- detection
- splunk
- bpfdoor
- vulnerability
Sigma Queries turned into KQL for Defender using pysigma - Automated
- detection-engineering
- kql
- microsoftsentinel
- mitre-attack
Sigma Queries turned into SPL for Splunk Enterprise and Enterprise Security using pysigma - Automated