Tools

xueboqiu/prohunter

Graph-based threat detection system using inexact graph vector matching to compare threat graphs with CTI-derived attack query graphs for automated…

joe-desimone/patriot

In-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…

d4vinci/eagleeye

A host-based IDS and network monitoring system (My graduation project)

mukendi/kratosminifilter

Kratos is a high-performance Windows File System Minifilter driver designed to detect, block, and permanently immunize

lucadibello/network-attack-detection

Advanced detection of port scanning, DoS and malware attacks using Machine Learning techniques

gpt-laboratory/trustworthyrag

An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Retrieval-Augmented Generation Systems.

lightless-labs/third-thoughts

Research toolkit for analyzing AI agent behavioral patterns through multi-disciplinary corpus analysis. Parses session logs, runs 23 analytical…

ny1024/clawguard

Modular security toolkit for autonomous agents providing static analysis, configuration auditing, runtime monitoring, and supply chain verification…

itzmeshervin/siem-dashboard

A lightweight, real-time Security Information and Event Management (SIEM) dashboard built using Streamlit. It collects system logs, detects USB and…

nccgroup/reactor

Runs custom filters on Elasticsearch and alerts on matches

theflink/hunt-weird-imageloads

Small tool to play with IOCs caused by Imageload events

thingsboard/thingsboard

Open-source IoT Platform - Device management, data collection, processing and visualization.

osquery/osquery

SQL powered operating system instrumentation, monitoring, and analytics.

wazuh/wazuh

Open-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…

allinurl/goaccess

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.

yzhao062/pyod

A Python library for anomaly detection across tabular, time series, graph, text, image, and audio data. 60+ detectors, benchmark-backed ADEngine…

stamparm/maltrail

Real-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…

falcosecurity/falco

Real-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…