Log Analysis

activecm/rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

hubblestack/hubble

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event…

fail2ban/fail2ban

Daemon to ban hosts that cause multiple authentication errors

clong/detectionlab

Automate the creation of a lab environment complete with security tooling and logging best practices

ghostop14/sparrow-wifi

Next-Gen GUI-based WiFi and Bluetooth Analyzer for Linux

trinitor/netstat2neo4j

create cypher create statements for neo4j out of netstat files from multiple machines

defenxor/dsiem

Security event correlation engine for ELK stack

omerbenamram/evtx

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format

allinurl/goaccess

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.

la3ar0v/tuxresponse

Automated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.

agent-hellboy/ltm

ltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…

mitre/brawl-public-game-001

Data from a BRAWL Automated Adversary Emulation Exercise

randomuserid/adama

Searches For Threat Hunting and Security Analytics

cyberark/skywrapper

SkyWrapper helps to discover suspicious creation forms and uses of temporary tokens in AWS

hxnoyd/ossem-power-up

A tool to assess data quality, built on top of the awesome OSSEM.

pavel-odintsov/fastnetmon

Very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support