1.crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
+2,270 stars
from 13,174 · score 7.73
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
25 repositories by Attention Score · May 8, 2026 – Nov 3, 2026 (UTC)
2.wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
- security
- compliance
- log-analysis
- vulnerability-detection
- cybersecurity
- file-integrity-monitoring
- +14 more
+2,157 stars
from 15,399 · score 7.68
3.fail2ban / fail2ban
Daemon to ban hosts that cause multiple authentication errors
+1,370 stars
from 17,574 · score 7.22
4.SigmaHQ / sigma
Main Sigma Rule Repository
- security
- monitoring
- siem
- logging
- signatures
- elasticsearch
- +3 more
+1,039 stars
from 10,360 · score 6.95
5.falcosecurity / falco
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
- ebpf
- kubernetes
- +4 more
+667 stars
from 8,883 · score 6.50
6.osquery / osquery
SQL powered operating system instrumentation, monitoring, and analytics.
- security
- monitoring
- intrusion-detection
- sql
- hacktoberfest
+559 stars
from 23,161 · score 6.33
7.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+536 stars
from 4,614 · score 6.29
+399 stars
from 2,556 · score 5.99
9.Yamato-Security / hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
+306 stars
from 3,130 · score 5.73
10.stamparm / maltrail
Malicious traffic detection system
+274 stars
from 8,375 · score 5.62
11.aquasecurity / tracee
Linux Runtime Security and Forensics using eBPF
+202 stars
from 4,461 · score 5.31
12.cisagov / Malcolm
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
- network-security
- pcap
- security
- arkime
- cybersecurity
- infosec
- +7 more
+192 stars
from 2,387 · score 5.26
13.WithSecureOpenSource / chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
- attack
- rust
- security
- threat-hunting
- blueteam
- chainsaw
- +7 more
+185 stars
from 3,520 · score 5.23
14.OTRF / ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
- hunting
- dfir
- +3 more
+179 stars
from 4,527 · score 5.19
15.splunk / security_content
Splunk Security Content
- splunk
- detection
- engineering
- responses
- cicd
- cybersecurity
- +1 more
+117 stars
from 1,609 · score 4.77
16.rabbitstack / fibratus
Security sensor for realtime threat detection and protection
+115 stars
from 2,450 · score 4.75
17.ossec / ossec-hids
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
- ossec
- compliance
- +5 more
+102 stars
from 4,968 · score 4.63
+99 stars
from 2,078 · score 4.61
19.Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
- azure
- defender-for-endpoint
- dfir
- kql
- sentinel
- threat-hunting
- +9 more
+83 stars
from 1,685 · score 4.43
20.sans-blue-team / DeepBlueCLI
The repository host gives no description.
+49 stars
from 2,393 · score 3.91
21.baidu / openrasp
🔥Open source RASP solution
+46 stars
from 2,944 · score 3.85
22.matanolabs / matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
- aws
- cloud
- security
- big-data
- serverless
- apache-iceberg
- +14 more
+40 stars
from 1,667 · score 3.71
+32 stars
from 3,903 · score 3.50
24.Security-Onion-Solutions / security-onionArchived
Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
- intrusion-detection
- network-security-monitoring
- log-management
- ids
- nsm
- hunting
- +1 more
+31 stars
from 3,105 · score 3.47
25.mandiant / red_team_tool_countermeasuresArchived
The repository host gives no description.
+4 stars
from 2,659 · score 1.61