#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
ntop/ntopngWeb-based Traffic and Cybersecurity Network Traffic Monitoring
zoneminder/zoneminderZoneMinder is a free, open source Closed-circuit television software application developed for Linux which supports IP, USB and Analog cameras.
ossec/ossec-hidsOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…
ntop/ndpiOpen Source Deep Packet Inspection Software Toolkit
efforg/rayhunterRust tool to detect cell site simulators on an orbic mobile hotspot
netalertx/netalertxCentralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
cilium/tetragoneBPF-based Security Observability and Runtime Enforcement
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
0x4d31/awesome-threat-detectionCurated list of threat detection and hunting resources: detection rules, SIEM and log analysis tools, endpoint/network monitoring, datasets,…
the-tcpdump-group/libpcapSystem-independent library for user-level packet capture and filtering. Provides a portable framework for low-level network monitoring, security…
olafhartong/sysmon-modularA repository of sysmon configuration modules
elastic/detection-rulesDevelop, validate, and publish SIEM detection rules for Elastic Security, with Python CLI tooling, KQL parsing, Kibana integration, and packaged…
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
neo23x0/signature-baseYARA signature and IOC database for my scanners and tools
thinkst/canarytokensCanarytokens helps track activity and actions on your network
hacklcx/hfishEnterprise-grade honeypot system for detecting internal network breaches, external threats, and producing threat intelligence with 90+ service…
cyb3rxp/awesome-socA curated knowledge base to build, run and mature a SOC (including CSIRT).
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
