Defensive Tools

blakeblackshear/frigate

NVR with realtime local object detection for IP cameras

osquery/osquery

SQL powered operating system instrumentation, monitoring, and analytics.

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

wazuh/wazuh

Open-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…

azure/azure-sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

sandboxie-plus/sandboxie

Sandboxie Plus & Classic

lolbas-project/lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

google/gvisor

Sandboxes containers via a userspace application kernel that intercepts system calls, limits host kernel access, and integrates with…

prowler-cloud/prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.…

softethervpn/softethervpn

Cross-platform multi-protocol VPN server and client supporting SSL-VPN, WireGuard, OpenVPN, IPsec, L2TP, MS-SSTP, L2TPv3 and EtherIP with AES-256…

fail2ban/fail2ban

Daemon to ban hosts that cause multiple authentication errors

opennhp/opennhp

A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the…

nvidia/openshell

Sandboxed runtime for autonomous AI agents with declarative YAML policies enforcing filesystem, network, and process constraints, plus endpoint-bound…

sigmahq/sigma

Main Sigma Rule Repository

oauth2-proxy/oauth2-proxy

A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.

mail-in-a-box/mailinabox

Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server…