Tools

zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

aixisstudio/snitch

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8…

gopasteverything/gpewebdefender

Lightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.

gilnett/wstrace

Standalone zero-driver Windows system and API monitor in Rust

matheuzsecurity/ksentinel

Linux kernel integrity monitor for detecting syscall hooking

ossec/ossec-hids

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…

halildeniz/dnswatch

DNS traffic sniffer and analyzer for monitoring, filtering, and detecting anomalies in DNS queries. Features include PCAP export, DoH support, and a…

owasp/intrusion-alert-educational-network-ids

Lightweight Python-based IDS that monitors network traffic in real-time using Scapy, detecting DoS/DDoS attacks via per-IP request rate analysis with…

fusion1110/ebpf-hid_guard

Linux kernel-space HID injection attack detector using eBPF. Monitors USB and Bluetooth HID devices for anomalous keystroke timing and automatically…

sqall01/lsms

Linux Security and Monitoring Scripts

baidu/openrasp

Runtime application self-protection engine that hooks into application servers to monitor and block malicious database queries, file operations, and…

sigmahq/pysigma-backend-opensearch

pySigma OpenSearch backend

zypherion-technologies/nemesis

.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.

gmh5225/crowarmor

Linux kernel security driver using LSM to harden the system, monitor and restore syscall table integrity, and protect CPU control registers against…

otrf/set-auditrule

Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity

wecooperate/imonitorsdk

The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能，…

johnearle/coalmine

Cloud Canary Object Orchestration Management Platform

hardenedvault/ved-ebpf

eBPF-based runtime kernel security monitor detecting exploits and rootkits via control flow integrity (wCFI) and privilege escalation detection (PSD)…