Tools

wazuh/wazuh

Open-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…

trufflesecurity/trufflehog

Find, verify, and analyze leaked credentials

fleetdm/fleet

Open-source platform to secure and manage endpoints via MDM, patch management, software deployment, and osquery-powered visibility with compliance…

permiso-io-tools/cloudgrappler

Query high-fidelity cloud detections for known threat actors across AWS, Azure, and GCP using CloudTrail logs and custom threat intelligence rules.

eshlomo1/microsoft-sentinel-secops

SOC operations content for Microsoft Sentinel, including hunting queries, incident response playbooks, and security event analysis for Azure cloud…

jacobideji/aiiroverlay

AI IR Overlay™ — practical incident response framework for AI agents in production. Built on NIST SP 800-61 r3, mapped to NIST AI RMF, NIST CSF 2.0,…

kubeshark/kubeshark

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via…

opencspm/opencspm

Open Cloud Security Posture Management Engine

cloud-sniper/cloud-sniper

Detection-as-code platform that automates cloud security incident response by correlating artifacts, analyzing IOCs, and orchestrating…

kreotic/sentrygrid

ML-driven threat detection and continuous monitoring platform built for federal zero trust architectures.

cred-club/dial

Event-driven AWS security misconfiguration detection framework that monitors multiple accounts in real-time, triggering alerts via Lambda for IAM,…

knudsenmorten/clientinspectorv2

Azure-based client inventory and drift detection tool that collects Windows configuration data (antivirus, patching, Bitlocker) into LogAnalytics for…

blake-fm/vcenter-log4j

Script to apply official workaround for VMware vCenter log4j vulnerability CVE-2021-44228

devopstoday11/tarian

Anti-Virus for K8s. Protect your Applications running on Kubernetes from malicious attacks with pre-registered source code, runtime processes…

fabacab/awesome-cybersecurity-blueteam

💻🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.

puppetlabs-toy-chest/puppetlabs-cve20113872

Puppet Module to help fix and migrate a Puppet deployment (CVE-2011-3872)

all3xj/fixing-google-secops-detections

Tuning and refactoring Google Chronicle Curated Detections to eliminate alert fatigue and fix logic gaps/bugs.

aws-samples/drs-malware-scan

Perform file-based malware scan on your on-prem servers with AWS