Tools

aixisstudio/snitch

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8…

owasp/intrusion-alert-educational-network-ids

Lightweight Python-based IDS that monitors network traffic in real-time using Scapy, detecting DoS/DDoS attacks via per-IP request rate analysis with…

zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

baidu/openrasp

Runtime application self-protection engine that hooks into application servers to monitor and block malicious database queries, file operations, and…

halildeniz/dnswatch

DNS traffic sniffer and analyzer for monitoring, filtering, and detecting anomalies in DNS queries. Features include PCAP export, DoH support, and a…

wipi-hunter/pidense

🍓📡🍍Monitor illegal wireless network activities. (Fake Access Points), (WiFi Threats: KARMA Attacks, WiFi Pineapple, Similar SSID, OPN Network…

wecooperate/imonitorsdk

The world's most powerful System Activity Monitor Engine · 一款功能强大的终端行为采集防御开发套件 ~ 旨在帮助EDR、零信任、数据安全、审计管控等终端安全软件可以快速实现产品功能，…

hardenedvault/ved-ebpf

eBPF-based runtime kernel security monitor detecting exploits and rootkits via control flow integrity (wCFI) and privilege escalation detection (PSD)…

sleuthco/clawshield-public

Security proxy for AI agents. Scans every message for prompt injection, PII, and secrets. Defense-in-depth: Go proxy + iptables firewall + eBPF…

zypherion-technologies/nemesis

.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.

matheuzsecurity/ksentinel

Linux kernel integrity monitor for detecting syscall hooking

nccgroup/mimikatz-detector-condrv

The Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…

gilnett/wstrace

Standalone zero-driver Windows system and API monitor in Rust

gopasteverything/gpewebdefender

Lightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.

mr-r3b00t/cve-2026-0300

Deceptive honeypot designed to simulate and monitor exploitation attempts targeting CVE-2026-0300, capturing attacker behavior for analysis and…

gmh5225/crowarmor

Linux kernel security driver using LSM to harden the system, monitor and restore syscall table integrity, and protect CPU control registers against…

glen-testing/low-int-cert-monitor

Monitor Certificate Transparency logs for certificates with trivially small EC private keys (the eMudhra weak-key class). P-256/384/521.

jawadasghar471600-dot/wi-fi-fortress-auditor

Wi-Fi Security Audit & WPA2 Password Testing Guide 2026: Master Monitor Mode