1.crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
+99 stars
from 15,361 · score 4.61
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
35 repositories by Attention Score · Oct 29, 2026 – Nov 4, 2026 (UTC)
2.wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
- security
- compliance
- log-analysis
- vulnerability-detection
- cybersecurity
- file-integrity-monitoring
- +14 more
+90 stars
from 17,478 · score 4.51
3.aixisstudio / Snitch
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
- cybersecurity
- d3js
- electron
- fastapi
- network-monitor
- privacy
- +14 more
+83 stars
from 643 · score 4.43
4.fail2ban / fail2ban
Daemon to ban hosts that cause multiple authentication errors
+52 stars
from 18,901 · score 3.97
5.SigmaHQ / sigma
Main Sigma Rule Repository
- security
- monitoring
- siem
- logging
- signatures
- elasticsearch
- +3 more
+40 stars
from 11,364 · score 3.71
6.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+29 stars
from 5,125 · score 3.40
7.osquery / osquery
SQL powered operating system instrumentation, monitoring, and analytics.
- security
- monitoring
- intrusion-detection
- sql
- hacktoberfest
+28 stars
from 23,697 · score 3.37
8.falcosecurity / falco
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
- ebpf
- kubernetes
- +4 more
+18 stars
from 9,533 · score 2.94
9.Yamato-Security / hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
+15 stars
from 3,422 · score 2.77
+14 stars
from 2,942 · score 2.71
11.cisagov / Malcolm
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
- network-security
- pcap
- security
- arkime
- cybersecurity
- infosec
- +7 more
+14 stars
from 2,570 · score 2.71
12.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
- etw
- incident-response
- +14 more
+8 stars
from 519 · score 2.20
13.WithSecureOpenSource / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
- blueteam
- chainsaw
- +7 more
+7 stars
from 3,701 · score 2.08
14.splunk / security_content
Splunk Security Content
- splunk
- detection
- engineering
- responses
- cicd
- cybersecurity
- +1 more
+7 stars
from 1,720 · score 2.08
15.stamparm / maltrail
Malicious traffic detection system
+6 stars
from 8,646 · score 1.95
16.rabbitstack / fibratus
Security sensor for realtime threat detection and protection
+6 stars
from 2,560 · score 1.95
17.Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
- azure
- defender-for-endpoint
- dfir
- kql
- sentinel
- threat-hunting
- +9 more
+6 stars
from 1,763 · score 1.95
18.objective-see / BlockBlock
BlockBlock provides continual protection by monitoring persistence locations.
+6 stars
from 870 · score 1.95
19.aquasecurity / tracee
Linux Runtime Security and Forensics using eBPF
+5 stars
from 4,658 · score 1.79
20.ossec / ossec-hids
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
- ossec
- compliance
- +5 more
+4 stars
from 5,066 · score 1.61
21.OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
- hunting
- dfir
- +3 more
+4 stars
from 4,702 · score 1.61
22.SpacehuhnTech / DeauthDetector
Detect deauthentication frames using an ESP8266
+3 stars
from 988 · score 1.39
23.wagga40 / Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
- sigma
- python3
- evtx
- sigma-rules
- detection
- auditd
- +9 more
+3 stars
from 870 · score 1.39
+2 stars
from 3,933 · score 1.10
25.baidu / openrasp
🔥Open source RASP solution
+2 stars
from 2,989 · score 1.10
+2 stars
from 2,177 · score 1.10
27.matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
- aws
- cloud
- security
- big-data
- serverless
- apache-iceberg
- +14 more
+2 stars
from 1,706 · score 1.10
28.elastic / protections-artifacts
Elastic Security detection content for Endpoint
+2 stars
from 1,507 · score 1.10
29.step-security / harden-runner
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
- security-hardening
- runners
- +3 more
+2 stars
from 1,293 · score 1.10
30.jasonish / docker-suricata
A Suricata Docker image.
+2 stars
from 336 · score 1.10
31.Security-Onion-Solutions / security-onionArchived
Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
- intrusion-detection
- network-security-monitoring
- log-management
- ids
- nsm
- hunting
- +1 more
+1 stars
from 3,135 · score 0.69
32.sans-blue-team / DeepBlueCLI
The repository host gives no description.
+1 stars
from 2,442 · score 0.69
33.activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
- cyber-security
- network-traffic-analysis
- +10 more
+1 stars
from 666 · score 0.69
34.teler-sh / teler-waf
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
- ids
- teler
- waf
- teler-ids
- teler-waf
- go
- +8 more
+1 stars
from 406 · score 0.69
35.Cybereason-Public / owLSM
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
- ebpf
- security
- linux-kernel
- linux-security-module
- sigma-rule
+1 stars
from 281 · score 0.69