
SSHintel
Self-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.

Self-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.

TheLightScope

Open-source deception platform that turns any Linux machine into a high-signal canary. Deploy tripwire sensors on files, ports, and network services…

Lightweight web-attack monitor. One Go binary + SQLite. Not OSSEC, not a WAF.

Lightweight Python-based IDS that monitors network traffic in real-time using Scapy, detecting DoS/DDoS attacks via per-IP request rate analysis with…

Semantic Observability for UNIX Systems - A lightweight C-based system prober with AI-powered analysis

Lightweight network intrusion detection engine capturing live traffic with libpcap. Detects SYN/ICMP floods, port scans, and signature-based web…

XDP Based Lightweight and Fast Firewall

Sniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.

Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182.

Lightweight macOS detection agent built on Santa’s Endpoint Security telemetry.

A lightweight, real-time Security Information and Event Management (SIEM) dashboard built using Streamlit. It collects system logs, detects USB and…

A utility to safely generate malicious network traffic patterns and evaluate controls.

Honeynet Project generic authenticated datafeed protocol

Multivariate statistical network monitoring sensor that detects anomalies using PCA-based techniques, aggregating lightweight statistics from…

Lightweight honeypot for Apache HTTP Server path traversal vulnerability CVE-2021-41773, designed to capture and log exploitation attempts.