Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
kubeshark/kubesharkeBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via…
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
microsoft/msticpyMicrosoft Threat Intelligence Security Tools
ossec/ossec-hidsOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…
tsale/edr-telemetryThis project aims to compare and evaluate the telemetry of various EDR products.
beenuar/aisocOpen-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation.…
yeet-src/sigwireLive kernel signal observability tool using eBPF tracepoints to stream every signal raised on a Linux host, showing sender, target, disposition,…
ait-aecid/logdata-anomaly-minerThis tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources…
olafhartong/sysmon-modularA repository of sysmon configuration modules
alex188dot/agensicCryptographic terminal forensics and session replay for AI agents. Tracks, signs, and audits every command with provenance labels, replayable…
dobybaxter127/nimbus-vestigeA forensic reconstruction engine for cloud and identity incident response.
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
the-tcpdump-group/tcpdumpthe TCPdump network dissector
ghassan-elsman/crow-eyeOpen-source Windows forensics engine that acquires, parses, and correlates artifacts (MFT, USN, Registry, etc.) to reconstruct timelines with…
mandiant/macos-unifiedlogsParses Apple Unified Logs to extract process, thread, activity, timestamp, and message metadata from logarchives or live macOS systems into JSONL/CSV…
renich/paredLightweight, secure control plane & real-time web dashboard in Crystal for Linux firewalld and NetworkManager host security.
cristhiansm0/txdxcristhian_2023-cve-38831CVE-2023-38831 WinRAR lab: detection with Sysmon/Wazuh, reverse engineering with Ghidra, patch analysis, and remediation.
canyonroad/agentshExecution-Layer Security (ELS) for AI agents — policy-enforced shell with audit.
