thingsboard
thingsboard/thingsboardOpen-source IoT Platform - Device management, data collection, processing and visualization.
anomaly-detectioncloud-infrastructure-securityconfiguration-auditing+3
22.3k
thingsboard/thingsboardOpen-source IoT Platform - Device management, data collection, processing and visualization.
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
reprise99/sentinel-queriesCurated collection of Microsoft Sentinel KQL queries and tutorials for hunting threats, analyzing Azure AD sign-in logs, detecting anomalies, and…
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
salesforce/hasshHASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…
struppigel/portexJava library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
benjeems/packetstriderA network packet forensics tool for SSH
pe3zx/crowdstrike-falcon-queriesA collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
nccgroup/detectwindowscopyonwriteforapiEnumerate various traits from Windows processes as an aid to threat hunting
corelight/zeek-long-connectionsZeek package for tracking long connections to report them before they have completed.
nccgroup/impossibletravelloganalysisBasic log analysis tool to detect impossible travel via IP address geographic information
corelight/hasshFingerprint SSH clients and servers.
