Tools

microlaser/dns_watchdog_windows2

PowerShell script that monitors Windows DNS traffic via pktmon to detect poisoning, spoofing, rogue resolver responses, and gateway MAC changes,…

gopasteverything/gpewebdefender

Lightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.

arkime/arkime

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

dshield-isc/dshield

Installs and configures a DShield honeypot sensor on Raspberry Pi or Ubuntu, running Cowrie SSH and HTTP honeypots and forwarding firewall logs to…

backbay-labs/thrunt-god

Threat hunting command system for agentic IDEs

hpfeeds/hpfeeds

Honeynet Project generic authenticated datafeed protocol

jaksi/sshesame

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

phpatch/weblogchecker

Free access-log compromise analyzer: webshell interactions, exploitation patterns and brute-force bursts in your Apache/nginx logs - severity,…

malwaretech/log4jtools

Tools for investigating Log4j CVE-2021-44228

dragon-lady/netward-standalone

User-space bot and DDoS deflection for small HTTP services

kismetwireless/kismet

Github mirror of official Kismet repository

pedramamini/threatingestor

Automated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…

the-tcpdump-group/libpcap

System-independent library for user-level packet capture and filtering. Provides a portable framework for low-level network monitoring, security…

0xajstrike/opcuatrap

High-interaction OPC UA honeypot for ICS/SCADA — multi-profile (oil & gas, water, power grid), live process simulation, per-session threat scoring,…

cred-club/artif

An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.

ma111e/melody

Melody is a transparent internet sensor built for threat intelligence. Supports custom tagging rules and vulnerable application simulation.

logisek/baconsampler

Sniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.

nesg-ugr/msnm-sensor

Multivariate statistical network monitoring sensor that detects anomalies using PCA-based techniques, aggregating lightweight statistics from…