#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
imthenachoman/how-to-secure-a-linux-serverStep-by-step guide for hardening a Linux server, covering SSH security, firewalls, intrusion detection, auditing, and system configuration to reduce…
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
wazuh/wazuhOpen-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…
azure/azure-sentinelCloud-native SIEM for intelligent security analytics for your entire enterprise.
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
mail-in-a-box/mailinaboxMail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server…
crowdsecurity/crowdsecOpen-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…
owasp-modsecurity/modsecurityModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
misp/mispMISP (core software) - Open Source Threat Intelligence and Sharing Platform
graylog2/graylog2-serverCentralized log management platform for collecting, indexing, and analyzing streaming logs, with alerting and event correlation for security…
falcosecurity/falcoReal-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
oisf/suricataOpen-source network IDS/IPS/NSM engine for real-time traffic inspection, intrusion detection and prevention, protocol analysis, and rule-based threat…
telekom-security/tpotce🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
evilsocket/opensnitchInteractive GNU/Linux application firewall that filters outbound connections, blocks ads and malware domains, manages system firewall rules via GUI,…
