#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
digitalruby/ipbanAutomated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…
dougburks/so-cratesSO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
falconforceteam/falcondashAzure workbook dashboard that visualizes and explores detection performance metrics, helping security teams measure and proactively maintain their…
lucadibello/network-attack-detectionAdvanced detection of port scanning, DoS and malware attacks using Machine Learning techniques
corelight/corelightforsecopsChronicle parser for CORELIGHT and related information.
gitlab-security-oss/tldrSigma-based detection rules, log queries, atomic tests, and response procedures for monitoring and threat hunting in GitLab environments.
neo23x0/process-watcherA process monitoring tool that tries to detect exploitation
jsitech/jshielderHardening Script for Linux Servers/ Secure LAMP-LEMP Deployer/ CIS Benchmark
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
swastiksagar/wazuhlabprojectHands-on Wazuh SIEM/XDR home lab covering OVA deployment, agent enrollment, file integrity monitoring, VirusTotal malware detection, and MITRE ATT&CK…
imthenachoman/how-to-secure-a-linux-serverStep-by-step guide for hardening a Linux server, covering SSH security, firewalls, intrusion detection, auditing, and system configuration to reduce…
hacklcx/hfishEnterprise-grade honeypot system for detecting internal network breaches, external threats, and producing threat intelligence with 90+ service…
liuz233/hardeResearch code for HARDE, an agent harness that probes and adaptively optimizes components for runtime risk detection and execution control across…
josevnz/suricatalogParse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…
fankh/vulnerability-pocCVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security…
wattocyber/detection-defense-libraryDetection-engineering reference mapping Windows, cloud, container, identity, and ICS attack classes to Sigma rules, trust-boundary models, BYOVD…
zoneminder/zoneminderZoneMinder is a free, open source Closed-circuit television software application developed for Linux which supports IP, USB and Analog cameras.
