Log Analysis

ox-eye/ox4shell

Deobfuscate Log4Shell payloads with ease.

matanolabs/matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

silverfort-open-source/latma

Collects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…

romaissaadjailia/get-applockereventlog

This is a repo for fetching Applocker event log by parsing the win-event log

jamf/aftermath

Swift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…

georgi-i/winevt_logs_analysis

Parses Windows .evtx logs to identify remote connections and public IPs by analyzing EventIDs related to remote logins and sessions.

mazx0p/threathound

Automated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…

trinitor/cve-vulnerability-information-downloader

Downloads and aggregates CVSS, EPSS, and CISA known exploited vulnerability data into unified JSON/CSV files and a SQLite database. Enriches…

digitalruby/ipban

Automated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…

ab2pentest/macosthreattrack

Bash tool used for proactive detection of malicious activity on macOS systems.

sap8899/reportly

AzureAD/EntraID user activity reporter for blue teams. Input a suspicious user and time frame to receive a detailed report of user info, actions, and…

otrf/ossem

Community-driven project for documenting, standardizing, and modeling security event logs to improve detection analytics and data normalization…

withsecurelabs/linuxcatscale

Incident Response collection and processing scripts with automated reporting scripts

password123456/ssl-certificate-expiry-date-checker

Scans SSL/TLS certificates for expiry dates, issuer details, and OCSP status. Sends notifications via webhook, Telegram, or Slack. Supports proxy per…

fenkohq/dnsmonster

Passive DNS Capture and Monitoring Toolkit

al0ne/cloud-audit

Automated cloud security auditing tool that detects AK/SK credential misuse by periodically auditing cloud platform logs using anomaly detection,…