Defensive Tools

osquery/osquery

SQL powered operating system instrumentation, monitoring, and analytics.

azure/azure-sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

wazuh/wazuh

Open-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…

sandboxie-plus/sandboxie

Sandboxie Plus & Classic

fail2ban/fail2ban

Daemon to ban hosts that cause multiple authentication errors

opennhp/opennhp

A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the…

justcallmekoko/esp32marauder

A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32

crowdsecurity/crowdsec

Open-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…

evilsocket/opensnitch

Interactive GNU/Linux application firewall that filters outbound connections, blocks ads and malware domains, manages system firewall rules via GUI,…

cure53/dompurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of…

objective-see/lulu

Open-source macOS firewall that monitors and controls network connections, blocking unauthorized outbound and inbound traffic with per-application…

zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

kata-containers/kata-containers

Secure OCI container runtime that runs workloads inside lightweight VMs, providing strong isolation across Kubernetes, containerd, and CRI-O with…

stamparm/maltrail

Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…

telekom-security/tpotce

🍯 T-Pot - The All In One Multi Honeypot Platform 🐝

oisf/suricata

Open-source network IDS/IPS/NSM engine for real-time traffic inspection, intrusion detection and prevention, protocol analysis, and rule-based threat…

lolbas-project/lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)