1.crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
+2,275 stars
from 13,185 · score 7.73
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
50 repositories by Attention Score · May 9, 2026 – Nov 4, 2026 (UTC)
2.wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
- security
- compliance
- log-analysis
- vulnerability-detection
- cybersecurity
- file-integrity-monitoring
- +14 more
+2,158 stars
from 15,410 · score 7.68
3.fail2ban / fail2ban
Daemon to ban hosts that cause multiple authentication errors
+1,367 stars
from 17,586 · score 7.22
4.SigmaHQ / sigma
Main Sigma Rule Repository
- security
- monitoring
- siem
- logging
- signatures
- elasticsearch
- +3 more
+1,040 stars
from 10,364 · score 6.95
5.falcosecurity / falco
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
- ebpf
- kubernetes
- +4 more
+667 stars
from 8,884 · score 6.50
6.osquery / osquery
SQL powered operating system instrumentation, monitoring, and analytics.
- security
- monitoring
- intrusion-detection
- sql
- hacktoberfest
+563 stars
from 23,162 · score 6.34
7.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+534 stars
from 4,620 · score 6.28
+399 stars
from 2,557 · score 5.99
9.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
- etw
- incident-response
- +14 more
+380 stars
from 147 · score 5.94
10.Yamato-Security / hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
+306 stars
from 3,131 · score 5.73
11.stamparm / maltrail
Malicious traffic detection system
+274 stars
from 8,378 · score 5.62
12.aquasecurity / tracee
Linux Runtime Security and Forensics using eBPF
+202 stars
from 4,461 · score 5.31
13.cisagov / Malcolm
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
- network-security
- pcap
- security
- arkime
- cybersecurity
- infosec
- +7 more
+197 stars
from 2,387 · score 5.29
14.WithSecureOpenSource / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
- blueteam
- chainsaw
- +7 more
+188 stars
from 3,520 · score 5.24
15.step-security / harden-runner
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
- security-hardening
- runners
- +3 more
+180 stars
from 1,115 · score 5.20
16.OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
- hunting
- dfir
- +3 more
+179 stars
from 4,527 · score 5.19
17.activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
- cyber-security
- network-traffic-analysis
- +10 more
+119 stars
from 548 · score 4.79
18.splunk / security_content
Splunk Security Content
- splunk
- detection
- engineering
- responses
- cicd
- cybersecurity
- +1 more
+118 stars
from 1,609 · score 4.78
19.rabbitstack / fibratus
Security sensor for realtime threat detection and protection
+115 stars
from 2,451 · score 4.75
20.ossec / ossec-hids
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
- ossec
- compliance
- +5 more
+102 stars
from 4,968 · score 4.63
+99 stars
from 2,080 · score 4.61
22.elastic / protections-artifacts
Elastic Security detection content for Endpoint
+90 stars
from 1,419 · score 4.51
23.objective-see / BlockBlock
BlockBlock provides continual protection by monitoring persistence locations.
+86 stars
from 790 · score 4.47
24.Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
- azure
- defender-for-endpoint
- dfir
- kql
- sentinel
- threat-hunting
- +9 more
+84 stars
from 1,685 · score 4.44
25.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
- detection
- auditd
- +9 more
+69 stars
from 804 · score 4.25
26.SpacehuhnTech / DeauthDetector
Detect deauthentication frames using an ESP8266
+60 stars
from 931 · score 4.11
27.sans-blue-team / DeepBlueCLI
The repository host gives no description.
+49 stars
from 2,394 · score 3.91
28.baidu / openrasp
🔥Open source RASP solution
+47 stars
from 2,944 · score 3.87
29.matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
- aws
- cloud
- security
- big-data
- serverless
- apache-iceberg
- +14 more
+41 stars
from 1,667 · score 3.74
30.chronicle / detection-rules
Collection of example YARA-L rules for use within Google Security Operations
+36 stars
from 487 · score 3.61
31.ahmedkhlief / APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
- apt-attacks
- incident-response
- +2 more
+35 stars
from 1,397 · score 3.58
+31 stars
from 3,904 · score 3.47
33.Security-Onion-Solutions / security-onionArchived
Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
- intrusion-detection
- network-security-monitoring
- log-management
- ids
- nsm
- hunting
- +1 more
+31 stars
from 3,105 · score 3.47
34.cossacklabs / acra
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
- encryption-server
- encryption
- crypto
- cryptography
- security
- intrusion-detection
- +7 more
+26 stars
from 1,469 · score 3.30
35.panther-labs / panther-analysis
Built-in Panther detection rules and policies
- security
- python
- cybersecurity
- siem
+25 stars
from 447 · score 3.26
36.Cybereason-Public / owLSM
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
- sigma-rule
+22 stars
from 260 · score 3.14
37.jasonish / docker-suricata
A Suricata Docker image.
+18 stars
from 320 · score 2.94
+10 stars
from 974 · score 2.40
39.teler-sh / teler-waf
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
- teler-waf
- go
- +8 more
+9 stars
from 398 · score 2.30
40.GoogleCloudPlatform / security-analyticsArchived
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
- security
- gcp
- google-cloud
- bigquery
- chronicle
- cloud-security-command-center
- +7 more
+8 stars
from 362 · score 2.20
+6 stars
from 545 · score 1.95
42.BinaryDefense / artillery
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
+5 stars
from 1,034 · score 1.79
+5 stars
from 580 · score 1.79
44.mandiant / red_team_tool_countermeasuresArchived
The repository host gives no description.
+4 stars
from 2,659 · score 1.61
45.Gui774ume / ebpfkit-monitor
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
- linux
- security
- kernel
- rootkit
- linux-kernel
- ebpf
- +2 more
+4 stars
from 141 · score 1.61
46.mandiant / sunburst_countermeasuresArchived
The repository host gives no description.
+3 stars
from 558 · score 1.39
+2 stars
from 868 · score 1.10
+2 stars
from 351 · score 1.10
49.codeexpress / respounder
Respounder detects presence of responder in the network.
- responder
- golang
- network-security-monitoring
- network-security
- hackers
- llmnr
- +4 more
+2 stars
from 321 · score 1.10
50.inodee / threathunting-spl
Splunk code (SPL) for serious threat hunters and detection engineers.
- splunk
- threat-hunting
- use-case
- siem
- rules
- spl
+2 stars
from 292 · score 1.10