1.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+29 stars
from 5,125 · score 3.40
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
9 repositories by Attention Score · Oct 29, 2026 – Nov 4, 2026 (UTC)
2.falcosecurity / falco
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
- ebpf
- kubernetes
- +4 more
+18 stars
from 9,533 · score 2.94
3.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
- etw
- incident-response
- +14 more
+8 stars
from 519 · score 2.20
4.splunk / security_content
Splunk Security Content
- splunk
- detection
- engineering
- responses
- cicd
- cybersecurity
- +1 more
+7 stars
from 1,720 · score 2.08
5.aquasecurity / tracee
Linux Runtime Security and Forensics using eBPF
+5 stars
from 4,658 · score 1.79
6.baidu / openrasp
🔥Open source RASP solution
+2 stars
from 2,989 · score 1.10
7.matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
- aws
- cloud
- security
- big-data
- serverless
- apache-iceberg
- +14 more
+2 stars
from 1,706 · score 1.10
8.step-security / harden-runner
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
- security-hardening
- runners
- +3 more
+2 stars
from 1,293 · score 1.10
9.teler-sh / teler-waf
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
- teler-waf
- go
- +8 more
+1 stars
from 406 · score 0.69