thingsboard
thingsboard/thingsboardOpen-source IoT Platform - Device management, data collection, processing and visualization.
anomaly-detectioncloud-infrastructure-securityconfiguration-auditing+3
22.3k
thingsboard/thingsboardOpen-source IoT Platform - Device management, data collection, processing and visualization.
googlecloudplatform/professional-servicesCollection of Google Cloud solution examples and operational utilities for audit log monitoring, DLP de-identification, encryption key management,…
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
salesforce/hasshHASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…
spectralzero/netscopeOffline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
benjeems/packetstriderA network packet forensics tool for SSH
nccgroup/detectwindowscopyonwriteforapiEnumerate various traits from Windows processes as an aid to threat hunting
corelight/hasshFingerprint SSH clients and servers.
nccgroup/reactorRuns custom filters on Elasticsearch and alerts on matches
reprise99/sentinel-queriesCollection of KQL queries
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
silverfort-open-source/latmaCollects and analyzes AD and Azure AD authentication logs to detect lateral movement attacks using graph-based anomaly detection, visualizing…
nccgroup/impossibletravelloganalysisBasic log analysis tool to detect impossible travel via IP address geographic information
aquibpro/forensix-studioForensic intelligence platform that analyzes files, correlates threat indicators, maps behavior to MITRE ATT&CK, and generates actionable security…
struppigel/portexJava library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
pe3zx/crowdstrike-falcon-queriesA collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon