Ranked by Attention Score: stars gained over the last 90 complete days
49 repositories by Attention Score · Aug 7, 2026 – Nov 4, 2026 (UTC)
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Daemon to ban hosts that cause multiple authentication errors
Main Sigma Rule Repository
SQL powered operating system instrumentation, monitoring, and analytics.
Cloud Native Runtime Security
eBPF-based Security Observability and Runtime Enforcement
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Malicious traffic detection system
Linux Runtime Security and Forensics using eBPF
Rapidly Search and Hunt through Windows Forensic Artefacts
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
Splunk Security Content
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
Security sensor for realtime threat detection and protection
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
BlockBlock provides continual protection by monitoring persistence locations.
Elastic Security detection content for Endpoint
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Detect deauthentication frames using an ESP8266
The repository host gives no description.
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
🔥Open source RASP solution
Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
Collection of example YARA-L rules for use within Google Security Operations
Built-in Panther detection rules and policies
A Suricata Docker image.
Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
teler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets, unwanted crawlers, and brute force attacks.
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
Suricata rules for network anomaly detection
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
The Artillery Project is an open-source blue team tool designed to protect Linux and Windows operating systems through multiple methods.
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
Splunk code (SPL) for serious threat hunters and detection engineers.