LogsTotal
wagga40/logstotalSelf-hosted multi-engine Sigma detection for event logs
defensive-toolsdigital-forensicsincident-response+5
wagga40/logstotalSelf-hosted multi-engine Sigma detection for event logs
supermhel/fengardeOpen-source, self-hosted security pipeline for IT, AI and OT. Logs in. Evidence out.: OCSF normalization, 46 detection rules…
neo23x0/process-watcherA process monitoring tool that tries to detect exploitation
jaksi/sshesameAn easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity
0xmfbk/ebpf-container-escape-frameworkAudit only eBPF EDR for Linux 5.15+ LTS: 14 kernel hooks, 15 actions (13 MITRE techniques), process lineage, SIEM export, K8s/Docker ready.
ndaal_open_source/ndaal_public_auditdBest-practice Linux Auditd rule set with 14,956 MITRE ATT&CK-mapped rules, Ansible deployment role, and lint/test tooling for security monitoring and…
haidang-infosec/phantom-gridAn eBPF-powered Active Defense system that turns your Linux server into a deceptive honeypot. Features transparent traffic redirection, OS…
joseluispino/hardstopReference implementation for "Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution". Out-of-band Epistemic Andon Cord,…
damnkrishna/cve-2025-32433-labA Flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without…
bombinisecurity/bombinieBPF Security Monitoring and Sandboxing Agent Based on Aya
ivankovic/stop-botsAutomate stopping bad bots from accessing your server
falconforceteam/falcondashAzure workbook dashboard that visualizes and explores detection performance metrics, helping security teams measure and proactively maintain their…
duggytuxy/syswardenHost-local Linux security orchestrator enforcing nftables policy with HIDS/HIPS telemetry, bounded threat-intelligence feeds, out-of-band WAAP log…
fankh/vulnerability-pocCVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security…
elihiho/security-operations-labsThreat Modeling, IT-/OT-Segmentierung, Snort Detection und reproduzierbare Validierung eines Drupal-Detection-Profils.
d3vhex/sentoraAn open-source, self-hosted AI-powered SIEM, EDR and SOAR platform for modern security operations.
ashok523/cve-2026-31431Defensive IR playbook and detection package for CVE-2026-31431 (Copy Fail) Linux kernel LPE, including Sigma, auditd, Falco, Wazuh, YARA, eBPF, and…
detect-defenselab/cve-2026-31431-detection-defenseResearch and detection guidance for CVE-2026-31431, an io_uring-based bypass of syscall monitoring. Provides detection rules for Tetragon, Falco, and…