#1Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
Kitploit recommended
raj3shp/malscoreMaliciousness scoring for Linux commands
0xmfbk/ebpf-container-escape-frameworkAudit only eBPF EDR for Linux 5.15+ LTS: 14 kernel hooks, 15 actions (13 MITRE techniques), process lineage, SIEM export, K8s/Docker ready.
g4bri-3l3/hostbadgerRead-only Windows host hardening auditor in PowerShell with optional AI analysis
lascc/dfirhubSearch artifact paths, build collection scripts, and convert Sigma rules. All in one place.
oyesanyf/oshoosiclawAutonomous Rust endpoint security agent combining Ring-0 Windows driver and Linux eBPF pre-execution blocking, YARA detection, MITRE ATT&CK mapping,…
szzxli/soc-home-labHands-on cybersecurity lab: mini-SOC on AWS, CloudTrail IOC analyzer, phishing analysis lab, ELF binary triage, SOC agent skills
owasp/piihunterScans PostgreSQL databases and Jira issues for PII using regex, NER/ML, and optional self-hosted LLM detection, with redacted reports and audit…
gmh5225/maldec-edrUnix endpoint detection and response solution using kernel-level mechanisms to detect anomalies and malware attacks in real time.
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of KAPE collections, one run per host, with per-host reports and a cross-host triage dashboard
perplexityai/numbatVisibility into AI agent activity on endpoints, with on-device detection, optional pre-action blocking, and forensic reconstruction.
cognis-digital/c2detectC2 server fingerprinter — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel
swastiksagar/wazuhlabprojectHands-on Wazuh SIEM/XDR home lab covering OVA deployment, agent enrollment, file integrity monitoring, VirusTotal malware detection, and MITRE ATT&CK…
jev-sec/jev-idsBlazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.
gmh5225/llm-guard-serviceA service to provide protection against prompt injection, jailbreak attacks, and harmful content when interacting with AI services..
gilnett/wstraceStandalone zero-driver Windows system and API monitor in Rust
vighnesh91/cloudgarrisonOffline browser-based multi-cloud posture workbench that simulates attack paths, audits IaC compliance, analyzes identity graphs, and maps audit logs…
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
trustedsec/artilleryOpen-source blue team tool that protects Linux and Windows systems using multiple host and network defense and detection methods.
