AiSOC
beenuar/aisocSelf-hostable AI SOC that fuses security alerts, auto-triages via agentic AI, runs MITRE ATT&CK investigations, and logs every agent decision in a…
ai-securityanomaly-detectiondefensive-tools+5
5.4k
beenuar/aisocSelf-hostable AI SOC that fuses security alerts, auto-triages via agentic AI, runs MITRE ATT&CK investigations, and logs every agent decision in a…
ossec/ossec-hidsOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
crowdsecurity/crowdsecOpen-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…
bert-janp/open-source-threat-intel-feedsThis repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such…
ivankovic/stop-botsAutomate stopping bad bots from accessing your server
thinkst/opencanaryLow-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
ndaal_open_source/ndaal_public_auditdBest-practice Linux Auditd rule set with 14,956 MITRE ATT&CK-mapped rules, Ansible deployment role, and lint/test tooling for security monitoring and…
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs
solidevil14/suricata-rule-for-detecting-cve-2025-55182CVE‑2025‑55182 Detection
corelight/emudhra-weak-keysA Zeek package that detects when compromised eMudhra intermediate certificates are used in TLS 1.2 and below.
aide/aideFile integrity monitoring tool that detects unauthorized changes to monitored files and directories using attribute checks, multiple hash algorithms,…
neo23x0/process-watcherA process monitoring tool that tries to detect exploitation
falcosecurity/falcoReal-time cloud-native runtime security agent for Linux that monitors syscalls and container/Kubernetes metadata to detect anomalous behavior and…
ahmed-tarek22752/security-vulnerability-in-microsoft-office.Blue-team analysis of a malicious DOCX exploiting CVE-2017-0199, covering sandbox detonation, network forensics, IOC extraction, MITRE ATT&CK…