#1IDS/IPS systems, network monitoring, anomaly-based detection, and threat alerting tools.
Kitploit recommended
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
gossithedog/threathuntingTools for hunting for threats.
volexity/threat-intelSignatures and IoCs from public Volexity blog posts.
scythe-io/purple-team-exercise-frameworkPurple Team Exercise Framework
bfuzzy/auditd-attackA Linux Auditd rule set mapped to MITRE's Attack Framework
metlo-labs/metloMetlo is an open-source API security platform.
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
alphasoc/flightsimA utility to safely generate malicious network traffic patterns and evaluate controls.
snorby/snorbyRuby On Rails Application For Network Security Monitoring
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
dinotools/dionaeaLow-interaction honeypot that emulates vulnerable network services to capture malware, shellcode, and exploit attempts, with IPv6 and TLS support.
thinkst/canarytokens-dockerDocker configuration to quickly setup your own Canarytokens.
syworks/waidpsWireless Auditing, Intrusion Detection & Prevention System
neo23x0/raccineA Simple Ransomware Vaccine
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
mfthomps/labtainersLabtainers: A Docker-based cyber lab framework
stamusnetworks/sciriusWeb interface for Suricata ruleset management, threat hunting, and rule tuning with multi-source feed aggregation, transformation, and activity…
