#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
douglas-042/douglas-042-hqCentral console for Douglas-042 HEADQUARTERS collectors. Sweeps a fleet, correlates results across hosts, and manages IOC feeds and SIEM delivery…
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
tica506/siem-queries-for-cve-2021-44228SIEM query collection for detecting Log4Shell (CVE-2021-44228) exploitation attempts. Provides ready-to-use detection rules for security monitoring…
0x4d31/awesome-threat-detectionCurated list of threat detection and hunting resources: detection rules, SIEM and log analysis tools, endpoint/network monitoring, datasets,…
efforg/rayhunterRust tool to detect cell site simulators on an orbic mobile hotspot
backbay-labs/thrunt-godThreat hunting command system for agentic IDEs
yangyang-research/whale-sentinel-servicesThe Whale Sentinel Services
perplexityai/numbatVisibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
barghest-ngo/meshEncrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…
hpfeeds/hpfeedsHoneynet Project generic authenticated datafeed protocol
sinologicnet/sipcheckMonitors Asterisk authentication logs and automatically bans IPs with repeated failed login attempts using iptables, with configurable thresholds and…
cisc0-gif/netcrackpiRPi3+ Network Cracker Setup Tool
kuniyal08/dirty-frag-cve-2026-43284A report on Dirty Frag, which is a Linux Local Privilege Escalation (LPE) vulnerability chain that allows an unprivileged user to gain root access
tdevworks/cve-2020-1472-zerologon-demo-detection-mitigationEducational demo of CVE-2020-1472 (ZeroLogon) detection using Windows Event Logs and Suricata IDS, plus mitigation via Windows Updates. Includes…
stackrox/stackroxThe StackRox Kubernetes Security Platform performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides…
mfarshad-abdullah-khan/cve-2025-53770-research🚨 Threat intel & incident response research on SharePoint "ToolShell" RCE zero-day (CVE-2025-53770). 🕵️♂️ Covers root-cause deserialization flaws,…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
