Defensive Tools

ossec/ossec-hids

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…

a-poc/blueteam-tools

Tools and Techniques for Blue Team / Incident Response

oisf/suricata

Open-source network IDS/IPS/NSM engine for real-time traffic inspection, intrusion detection and prevention, protocol analysis, and rule-based threat…

crowdsecurity/crowdsec

Open-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…

efforg/rayhunter

Rust tool to detect cell site simulators on an orbic mobile hotspot

clong/detectionlab

Automate the creation of a lab environment complete with security tooling and logging best practices

cilium/tetragon

eBPF-based Security Observability and Runtime Enforcement

hacklcx/hfish

Enterprise-grade honeypot system for detecting internal network breaches, external threats, and producing threat intelligence with 90+ service…

infosecn1nja/ad-attack-defense

Attack and defend active directory using modern post exploitation adversary tradecraft activity

zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

aquasecurity/tracee

Linux Runtime Security and Forensics using eBPF

freedomofpress/dangerzone

Take potentially dangerous PDFs, office documents, or images and convert them to safe PDFs

telekom-security/tpotce

🍯 T-Pot - The All In One Multi Honeypot Platform 🐝

anthropic-experimental/sandbox-runtime

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

pfsense/pfsense

Main repository for pfSense

ghostpack/seatbelt

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security…

danielbohannon/invoke-obfuscation

PowerShell Obfuscator