Log Analysis

t0pcyber/hawk

Powershell Based tool for gathering information related to O365 intrusions and potential Breaches

travisfsmith/sweetsecurity

Network Security Monitoring on Raspberry Pi type devices

wagga40/zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

ion28/bluespawn

An Active Defense and EDR software to empower Blue Teams

letsdefend/awesome-soc-analyst

Useful resources for SOC Analyst and SOC Analyst candidates.

tenzir/tenzir

Collect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…

ion-storm/sysmon-config

Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…

threathunters-io/laurel

Transform Linux Audit logs for SIEM usage

gossithedog/threathunting

Hunts for potential malware downloads and suspicious domain calls via common Windows LOLBins using YARA rules and Nexthink telemetry modules.

ahmedkhlief/apt-hunter

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…

mgeeky/decode-spam-headers

A script that helps you understand why your E-Mail ended up in Spam

sigmahq/pysigma

Python library to parse and convert Sigma rules into queries (and whatever else you could imagine)

matanolabs/matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

yampelo/beagle

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

omerbenamram/evtx

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format

invictus-ir/microsoft-extractor-suite

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.

snorby/snorby

Ruby On Rails Application For Network Security Monitoring