
packetfence
PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…

PoC, non-destructive version scanner, KASAN crash verifier, and Suricata/Sigma detection rules for the Linux kernel TCP/IPv4 IP-options…

Python library to parse and convert Sigma rules into queries (and whatever else you could imagine)

Parse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…

A binary and file access authorization system for macOS.

Real-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…

A process monitoring tool that tries to detect exploitation

File integrity monitoring tool that detects unauthorized changes to monitored files and directories using attribute checks, multiple hash algorithms,…

Generates efficient IPv4 blocklists from Zeek network flows using multiple prioritization models (new, consistent, random forest) to identify…

Rust tool to detect cell site simulators on an orbic mobile hotspot

Kernel-level eBPF sandbox for securing LLM agent tool calls made through the Model Context Protocol (MCP)

JA4+ is a suite of network fingerprinting standards

Open-source detection engineering tool that traces security detections end to end and identifies the first failing stage.

Pwsh tool for AD Group Enumeration Auditing

A Go library for using zeek broker's websocket API

This tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources…

Splunk detection writeup for CVE-2026-54121 (CertiGhost): AD CS certificate chase abuse leading to full domain compromise. Lab-validated detection,…