#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
josevnz/suricatalogParse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…
fankh/vulnerability-pocCVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security…
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
zoneminder/zoneminderZoneMinder is a free, open source Closed-circuit television software application developed for Linux which supports IP, USB and Analog cameras.
cilium/tetragoneBPF-based Security Observability and Runtime Enforcement
fox-it/cisco-ios-xe-implant-detectionCisco IOS XE implant scanning & detection (CVE-2023-20198, CVE-2023-20273)
facebook/mcpguard-dynamicKernel-level eBPF sandbox for securing LLM agent tool calls made through the Model Context Protocol (MCP)
matthart1983/netwatchReal-time network diagnostics in your terminal. One command, zero config, instant visibility.
sonitbahl/sshintelSelf-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.
ethan-andrews/exploitarium-detectionsKQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of…
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
a3sal0n/falcongateA smart gateway to stop cyber criminals - Sponsored by Falcon Guard
arpsyndicate/vedas-signaturesVEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for over 15k CVEs
travisbgreen/hunting-rulesSuricata rules for network anomaly detection
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
all3xj/fixing-google-secops-detectionsTuning and refactoring Google Chronicle Curated Detections to eliminate alert fatigue and fix logic gaps/bugs.
umidguluzada/cyberdefense-labA complete Blue Team Cybersecurity Lab featuring pfSense, Suricata, and ELK Stack for network monitoring and threat detection.
rbidou/pyraspRuntime Application Self Protection for Python web servers, serverless functions and MCP servers, detecting attacks, prompt injection and data leaks…
