Sealighter
pathtofile/sealighterETW and WPP tracing tool for security research. Subscribes to multiple providers, auto-parses events to JSON, and supports advanced filtering,…
forensicslog-analysis
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
pathtofile/sealighterETW and WPP tracing tool for security research. Subscribes to multiple providers, auto-parses events to JSON, and supports advanced filtering,…
airbus-cert/etl-parserEvent Trace Log file parser in pure Python
matanolabs/matanoOpen source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
romaissaadjailia/get-applockereventlogThis is a repo for fetching Applocker event log by parsing the win-event log
jamf/aftermathSwift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…
georgi-i/winevt_logs_analysisParses Windows .evtx logs to identify remote connections and public IPs by analyzing EventIDs related to remote logins and sessions.
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
trinitor/cve-vulnerability-information-downloaderDownloads and aggregates CVSS, EPSS, and CISA known exploited vulnerability data into unified JSON/CSV files and a SQLite database. Enriches…
digitalruby/ipbanAutomated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…
ab2pentest/macosthreattrackBash tool used for proactive detection of malicious activity on macOS systems.
sap8899/reportlyAzureAD/EntraID user activity reporter for blue teams. Input a suspicious user and time frame to receive a detailed report of user info, actions, and…
otrf/ossemCommunity-driven project for documenting, standardizing, and modeling security event logs to improve detection analytics and data normalization…
withsecurelabs/linuxcatscaleIncident Response collection and processing scripts with automated reporting scripts
password123456/ssl-certificate-expiry-date-checkerScans SSL/TLS certificates for expiry dates, issuer details, and OCSP status. Sends notifications via webhook, Telegram, or Slack. Supports proxy per…
fenkohq/dnsmonsterPassive DNS Capture and Monitoring Toolkit