forensic-msvpn
synacktiv/forensic-msvpnThis repository contains Velociraptor artifact and Chainsaw rules to help detect Microsoft Remote Access VPN activity
forensicsdigital-forensicsincident-response+1
6
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
synacktiv/forensic-msvpnThis repository contains Velociraptor artifact and Chainsaw rules to help detect Microsoft Remote Access VPN activity
letsdefend/awesome-soc-analystUseful resources for SOC Analyst and SOC Analyst candidates.
sap8899/reportlyAzureAD/EntraID user activity reporter for blue teams. Input a suspicious user and time frame to receive a detailed report of user info, actions, and…
d3vl/l3monWeb-based network monitoring system providing real-time bandwidth tracking, server performance metrics, and customizable alerts for proactive network…
forensicxlab/vision-procmonA ProcessMonitor visualization application written in rust.
corelight/zeek-community-idZeek support for Community ID flow hashing.
hubblestack/hubbleHubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event…
georgi-i/winevt_logs_analysisParses Windows .evtx logs to identify remote connections and public IPs by analyzing EventIDs related to remote logins and sessions.
c3rb3ru5d3d53c/signaturesCommunity Detection Signature Build and Distribution Pipeline for YARA, Suricata, Snort and Sigma
corelight/zeek-openvpnA Zeek OpenVPN protocol analyzer plugin.
snorby/snorbyRuby On Rails Application For Network Security Monitoring
mandiant/mandiant-azure-ad-investigator
jsa2/eastExtensible Azure Security Tool - Documentation
lucadibello/network-attack-detectionAdvanced detection of port scanning, DoS and malware attacks using Machine Learning techniques
nccgroup/reactorRuns custom filters on Elasticsearch and alerts on matches
