zeek
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
anomaly-detectionanti-botdefensive-tools+14
7.9k
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
itsmoorgrove/tgscopeTelegram OSINT, scraping and archival as a local web app. Multi-account collection, profile lookup with historic photos and change diffs, ten export…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
mitre/brawl-public-game-001Data from a BRAWL Automated Adversary Emulation Exercise
antisurveillanceagency/shadownetShadowNet is an anonymous routing protocol that forces all connections (system-wide) to go through Tor while implementing Mixnet-like…
b16f00t/whapaGraphical forensic toolkit for parsing, decrypting, and extracting WhatsApp data from Android and iOS devices, including Google Drive and iCloud…
fboldewin/atmmalscanCommand-line DFIR tool for scanning Windows ATM systems to detect malware traces in process memory and disk, with automated memory dump creation for…
circl/ail-frameworkAIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project
intelowlproject/intelowlScalable threat intelligence platform that enriches observables and files using 200+ analyzers, with built-in GUI, REST API, and automated workflows…
emalderson/thephishThePhish: an automated phishing email analysis tool
guibacellar/texTelegram intelligence collection tool for researchers and investigators. Scrapes groups, messages, media, and user data with OCR, Elasticsearch…
securitybrewery/catalystSelf-hosted incident response platform with ticket management, automated reaction playbooks, task tracking, and dashboards for streamlining alert…
withsecurelabs/linuxcatscaleIncident Response collection and processing scripts with automated reporting scripts
nox-project/nox-frameworkHigh-performance OSINT/CTI framework for automated identity pivoting and risk analysis across 120+ sources.
la3ar0v/tuxresponseAutomated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.
caveeroo/gv_decryptorGallery Vault dump recovery tool with automated discovery, key derivation and automatic media restoration.
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
yamato-security/welaAudits Windows event log settings against best-practice guidelines and Sigma-rule detectability, with automated configuration for DFIR readiness.