zeek
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
defensive-toolsdns-analysisintrusion-detection+5
7.9k7h 32m ago
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
crowdsecurity/crowdsecOpen-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…
jay123anta/laravel-threat-detectionPassive Laravel middleware that detects and logs SQL injection, XSS, RCE, bot scanners, and 175+ attack patterns. Features a built-in dashboard,…
kuniyal08/dirty-frag-cve-2026-43284A report on Dirty Frag, which is a Linux Local Privilege Escalation (LPE) vulnerability chain that allows an unprivileged user to gain root access
beelzebub-labs/beelzebubA secure low code deception runtime framework, leveraging AI for System Virtualization.
linux-audit/audit-kernelGitHub mirror of the Linux Kernel's audit repository
sigmahq/pysigmaPython library to parse and convert Sigma rules into queries (and whatever else you could imagine)
alloysecuregroup/phantomfsWindows honeypot using ProjFS to project decoy files that trigger Event Log and desktop alerts when accessed, with SMB remote session logging for…
foxio-llc/ja4JA4+ is a suite of network fingerprinting standards
ossec/ossec-hidsOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…
ares-sys/uefi_bootkit_softlandingFirst public analysis of SoftLanding UEFI bootkit: Ring -2 implant, CVE-2025-7029, 240+ Gigabyte boards, GPU AI evasion, dual C2. YARA + Sigma +…
agentshield-ai/sigma-aiSigma detection rules for AI agent security monitoring
evilsocket/opensnitchInteractive GNU/Linux application firewall that filters outbound connections, blocks ads and malware domains, manages system firewall rules via GUI,…
josevnz/suricatalogParse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs
securityclaw/securityclawA modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…