1.falcosecurity / falco
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
- ebpf
- kubernetes
- +4 more
+667 stars
from 8,884 · score 6.50
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
20 repositories by Attention Score · May 9, 2026 – Nov 4, 2026 (UTC)
2.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+534 stars
from 4,620 · score 6.28
3.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
- etw
- incident-response
- +14 more
+380 stars
from 147 · score 5.94
4.aquasecurity / tracee
Linux Runtime Security and Forensics using eBPF
+202 stars
from 4,461 · score 5.31
5.step-security / harden-runner
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
- security-hardening
- runners
- +3 more
+180 stars
from 1,115 · score 5.20
6.splunk / security_content
Splunk Security Content
- splunk
- detection
- engineering
- responses
- cicd
- cybersecurity
- +1 more
+118 stars
from 1,609 · score 4.78
7.baidu / openrasp
🔥Open source RASP solution
+47 stars
from 2,944 · score 3.87
8.matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
- aws
- cloud
- security
- big-data
- serverless
- apache-iceberg
- +14 more
+41 stars
from 1,667 · score 3.74
9.bombinisecurity / bombini
eBPF Security Monitoring and Sandboxing Agent Based on Aya
+37 stars
from 43 · score 3.64
10.chronicle / detection-rules
Collection of example YARA-L rules for use within Google Security Operations
+36 stars
from 487 · score 3.61
11.cossacklabs / acra
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
- encryption-server
- encryption
- crypto
- cryptography
- security
- intrusion-detection
- +7 more
+26 stars
from 1,469 · score 3.30
12.panther-labs / panther-analysis
Built-in Panther detection rules and policies
- security
- python
- cybersecurity
- siem
+25 stars
from 447 · score 3.26
13.teler-sh / teler-waf
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
- teler-waf
- go
- +8 more
+9 stars
from 398 · score 2.30
14.GoogleCloudPlatform / security-analyticsArchived
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
- security
- gcp
- google-cloud
- bigquery
- chronicle
- cloud-security-command-center
- +7 more
+8 stars
from 362 · score 2.20
+6 stars
from 545 · score 1.95
+5 stars
from 580 · score 1.79
17.Gui774ume / ebpfkit-monitor
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
- linux
- security
- kernel
- rootkit
- linux-kernel
- ebpf
- +2 more
+4 stars
from 141 · score 1.61
+2 stars
from 868 · score 1.10
+2 stars
from 351 · score 1.10
20.codeexpress / respounder
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
- hackers
- llmnr
- +4 more
+2 stars
from 321 · score 1.10