#1Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
Kitploit recommended
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
ntop/ntopngWeb-based Traffic and Cybersecurity Network Traffic Monitoring
googlecloudplatform/professional-servicesCollection of Google Cloud solution examples and operational utilities for audit log monitoring, DLP de-identification, encryption key management,…
ossec/ossec-hidsOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
0x4d31/awesome-threat-detectionCurated list of threat detection and hunting resources: detection rules, SIEM and log analysis tools, endpoint/network monitoring, datasets,…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
the-tcpdump-group/tcpdumpthe TCPdump network dissector
olafhartong/sysmon-modularA repository of sysmon configuration modules
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
elastic/detection-rulesDevelop, validate, and publish SIEM detection rules for Elastic Security, with Python CLI tooling, KQL parsing, Kibana integration, and packaged…
cyb3rxp/awesome-socA curated knowledge base to build, run and mature a SOC (including CSIRT).
domcyrus/rustnetPer-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
withsecureopensource/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
