SQL powered operating system instrumentation, monitoring, and analytics.
Repository Index
47,133 repositories indexed
1–24 of 33 · Most stars
Daemon to ban hosts that cause multiple authentication errors
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Malicious traffic detection system
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
Linux Runtime Security and Forensics using eBPF
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Security sensor for realtime threat detection and protection
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
- encryption-server
- encryption
- crypto
- cryptography
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
Detect deauthentication frames using an ESP8266
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
USB Keystroke Injection Protection
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Collection of example YARA-L rules for use within Google Security Operations
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
Splunk code (SPL) for serious threat hunters and detection engineers.
- splunk
- threat-hunting
- use-case
- siem
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
The OTX Suricata Rule Generator can be used to create the rules and configuration for Suricata to alert on indicators from your OTX account.
OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans
- crowdsec
- intrusion-detection
- intrusion-detection-system
- intrusion-prevention