#1Behavioral anomaly detection, outlier analysis, UEBA, and statistical threat detection tools.
Kitploit recommended
online-ml/riverStreaming machine learning library for incremental learning on data streams, providing online estimators, drift and anomaly detection, pipelines,…
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
thinkst/canarytokensCanarytokens helps track activity and actions on your network
elastic/detection-rulesDevelop, validate, and publish SIEM detection rules for Elastic Security, with Python CLI tooling, KQL parsing, Kibana integration, and packaged…
stumpy-dev/stumpyScalable Python library for time series analysis via matrix profiles, enabling motif discovery, anomaly detection, semantic segmentation, and…
beenuar/aisocSelf-hostable AI SOC that fuses security alerts, auto-triages via agentic AI, runs MITRE ATT&CK investigations, and logs every agent decision in a…
microsoft/msticpyMicrosoft Threat Intelligence Security Tools
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
baidu/openraspRuntime application self-protection engine that hooks into application servers to monitor and block malicious database queries, file operations, and…
nzymeorg/nzymeWiFi, Bluetooth and Ethernet Threat Detection.
reprise99/sentinel-queriesCollection of KQL queries
stackrox/stackroxThe StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides…
tirrenotechnologies/tirrenoOpen-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks,…
logpai/loglizerA machine learning toolkit for log-based anomaly detection [ISSRE'16]
rob-med/awesome-ts-anomaly-detectionList of tools & datasets for anomaly detection on time-series data.
seldonio/alibi-detectAlgorithms for outlier, adversarial and drift detection
betterdb-inc/monitorReal-time monitoring and slowlog analysis for Valkey and Redis databases with anomaly detection, ACL auditing, and Prometheus metrics export.
rfxn/linux-malware-detectMulti-engine Linux malware scanner with five detection stages (MD5, HEX pattern, YARA, ClamAV, statistical), real-time inotify monitoring,…
