Log Analysis

adamwhitehat/judge-jury-and-executable

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…

corelight/ecs-mapping

Mapping Corelight or Zeek data to Elastic Common Schema fields

nextronsystems/evtx-baseline

A repository hosting example goodware evtx logs containing sample software installation and basic user interaction

fksvs/siper

XDP Based Lightweight and Fast Firewall

lethal-forensics/macos-collector

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

0x4d31/santamon

Lightweight macOS detection agent built on Santa’s Endpoint Security telemetry.

aws-alchemy/squidmagic

analyze a web-based network traffic 🕶 to detect central command and control servers

preflightsh/preflight

Go-based CLI tool that scans codebases for launch readiness, detecting missing configuration, security hygiene issues, secret leaks, and integration…

tayontech/scope

AI agent set for cloud security purple teaming, runs inside Claude Code, Gemini CLI, and Codex.

h21lab/tsharkvm

tshark + ELK analytics virtual machine

adversarial-detection-engineering/adversarial-detection-engineering-framework

A framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concrete examples…

matthart1983/essh

Enhanced SSH client with TUI — manage connections, keys, and sessions

speytech/c-sentinel

Semantic Observability for UNIX Systems - A lightweight C-based system prober with AI-powered analysis

thelightscope/thelightscope

TheLightScope

sap8899/reportly

AzureAD/EntraID user activity reporter for blue teams. Input a suspicious user and time frame to receive a detailed report of user info, actions, and…

rulebricks/claude-code-guardrails

Real-time guardrails for Claude Code tool calls.