#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
immersive-labs-sec/bruteratel-detectiontoolsA collection of Tools and Rules for decoding Brute Ratel C4 badgers
backbay-labs/thrunt-godThreat hunting command system for agentic IDEs
ostesayed/oste-web-log-analyzerOSTE WLA automate the process of analyzing web server logs with the Python Web Log Analyzer.
90n45-d3v/pinacoladaWireless Intrusion Detection System for Hak5's WiFi Coconut
jev-sec/jev-idsBlazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.
corelight/ripple20A Zeek package for the passive detection of "Ripple20" vulnerabilities in the Treck TCP/IP stack.
alwashali/detection-validationDetection rule validation
yardenshafir/conference_talksSlides from various conference talks
nccgroup/uninstalledappcanaryA Canary which fires when uninstalled
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs
camp0/aiengineProgrammable packet inspection engine with NIDS, DNS classification, frequency analysis, and auto-regex generation. Supports Python/Ruby/Java/Lua…
chen-keinan/kube-knarkOpen Source runtime tool which help to detect malware code execution and run time mis-configuration change on a kubernetes cluster
corelight/cve-2021-44228Zeek package for detecting Log4j CVE-2021-44228 exploit attempts via HTTP header payloads, LDAP Java class downloads, and second-stage Java class…
hullabrian/eventhorizonTool that gathers a customizable set of ETW telemetry and generates user-defined detections
d3sre/intelligentprocesslifecycleThe Intelligent Process Lifecycle of Active Cyber Defenders
wortell/cve-2020-0618CVE-2020-0618 Honeypot
sinologicnet/sipcheckMonitors Asterisk authentication logs and automatically bans IPs with repeated failed login attempts using iptables, with configurable thresholds and…
