
dns_watchdog_windows2
PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

Lightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

Chronicle parser for CORELIGHT and related information.

Hands-on Wazuh SIEM/XDR home lab covering OVA deployment, agent enrollment, file integrity monitoring, VirusTotal malware detection, and MITRE ATT&CK…

Installs and configures a DShield honeypot sensor on Raspberry Pi or Ubuntu, running Cowrie SSH and HTTP honeypots and forwarding firewall logs to…

Threat hunting command system for agentic IDEs

Honeynet Project generic authenticated datafeed protocol

Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

Tools for investigating Log4j CVE-2021-44228

Free access-log compromise analyzer: webshell interactions, exploitation patterns and brute-force bursts in your Apache/nginx logs - severity,…

Github mirror of official Kismet repository

User-space bot and DDoS deflection for small HTTP services

Deep Learning models for network traffic classification

Automated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…

A lightweight, real-time Security Information and Event Management (SIEM) dashboard built using Streamlit. It collects system logs, detects USB and…

System-independent library for user-level packet capture and filtering. Provides a portable framework for low-level network monitoring, security…