Log Analysis

ttlab-research/awesome-wazuh

🛡️Awesome lists about all kinds of interesting topics of Wazuh XDR/SIEM

punk-security/pwnspoof

Pwnspoof repository

sigmahq/sigma-cli

The Sigma command line interface based on pySigma

linnix-os/linnix

eBPF-powered Linux observability with AI incident detection. AGPL-3.0 licensed.

acquiredsecurity/forensic-timeliner

A high-speed forensic timeline engine for Windows forensic artifact CSV output built for DFIR investigators. Quickly consolidate CSV output from…

pe3zx/crowdstrike-falcon-queries

A collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon

joesecurity/sigma-rules

Sigma rules from Joe Security

pathtofile/sealighter

ETW and WPP tracing tool for security research. Subscribes to multiple providers, auto-parses events to JSON, and supports advanced filtering,…

permiso-io-tools/cloudgrappler

Query high-fidelity cloud detections for known threat actors across AWS, Azure, and GCP using CloudTrail logs and custom threat intelligence rules.

vignesh07/babyshark

Flows-first PCAP TUI (case files, gorgeous UX). Do do do do.

withsecurelabs/linuxcatscale

Incident Response collection and processing scripts with automated reporting scripts

jepaynemsft/weffles

Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI

cyb3r-monk/rita-j

Implementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.

byteray-labs/query-hub

CQL Hub is an open repository of detection and hunting queries for CrowdStrike NextGen SIEM and Falcon LogScale. All queries stored here are…

olafhartong/bamboozledr

A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.

zh54321/snafflerparser

Parses Snaffler output file and generate beautified outputs.