Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Repository Index
47,133 repositories indexed
1–17 of 17 · Most stars
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Malicious traffic detection system
The Hunting ELK
- hunting
- elasticsearch
- kibana
- logstash
🔥Open source RASP solution
Security sensor for realtime threat detection and protection
A Simple Ransomware Vaccine
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
A process monitoring tool that tries to detect exploitation
OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans
- crowdsec
- intrusion-detection
- intrusion-detection-system
- intrusion-prevention
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
- detection
- splunk
- bpfdoor
- vulnerability
Intrusion Prevention System (IPS) for Secure Shell (SSH)
🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.
- ai-security
- cybersecurity
- ids
- iot-security
Local-LLM alert triage for self-hosted SOCs.