Tools

falcosecurity/falco

Real-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…

sigmahq/pysigma

Python library to parse and convert Sigma rules into queries (and whatever else you could imagine)

jenderal92/ddos-traffic-monitor

A real-time traffic monitoring tool that detects and displays network traffic volume per IP address to identify potential DDoS attacks.

pedramamini/threatingestor

Automated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…

ne0zer01/cve-2024-27198_lab

Docker-based lab for CVE-2024-27198 TeamCity authentication bypass. Includes exploit reproduction, IoC hunting with Sigma/Suricata rules, and…

hullabrian/eventhorizon

Tool that gathers a customizable set of ETW telemetry and generates user-defined detections

petabi/sniffles

Sniffles: Packet Capture Generator for IDS and Regular Expression Evaluation

shellster/dcsyncmonitor

Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events.

foxio-llc/ja4

JA4+ is a suite of network fingerprinting standards

sans-blue-team/deepbluecli

PowerShell-based threat hunting tool that analyzes Windows Event Logs to detect malicious activity including credential attacks, obfuscated commands,…

benjeems/packetstrider

A network packet forensics tool for SSH

chen-keinan/kube-knark

Open Source runtime tool which help to detect malware code execution and run time mis-configuration change on a kubernetes cluster

metlo-labs/metlo

Metlo is an open-source API security platform.

josevnz/suricatalog

Parse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…

sinologicnet/sipcheck

Monitors Asterisk authentication logs and automatically bans IPs with repeated failed login attempts using iptables, with configurable thresholds and…