#1Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
Kitploit recommended
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
abdulrhmanalfaifi/fennecArtifact collection tool for *nix systems
v1d1an/s1emThis project is a SIEM with SIRP and Threat Intel, all in one.
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
josevnz/suricatalogParse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…
d3vl/l3monWeb-based network monitoring system providing real-time bandwidth tracking, server performance metrics, and customizable alerts for proactive network…
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
ctxis/snitchdnsDatabase Driven DNS Server with a Web UI
anssi-fr/dfir-o365rcPowerShell module for Office 365 and Azure log collection
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
t0pcyber/hawkPowershell Based tool for gathering information related to O365 intrusions and potential Breaches
oseguera12/cowrie-honeypot-digitaloceanMedium-interaction SSH/Telnet honeypot built with Cowrie, Loki, Promtail, and Grafana - provisioned on DigitalOcean via Terraform with a GitLab CI…
big-comfy/deadairFinds the detection rules in your SIEM that are running blind
tirrenotechnologies/tirrenoOpen-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks,…
imthenachoman/how-to-secure-a-linux-serverStep-by-step guide for hardening a Linux server, covering SSH security, firewalls, intrusion detection, auditing, and system configuration to reduce…
g0tmi1k/kippo-g0tmi1kMedium-interaction SSH honeypot that logs brute force attacks and full attacker shell interactions, with customization options to reduce…
dfir-dd/dfir-toolkitCLI tools for forensic investigation of Windows artifacts
