fail2ban
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
defensive-toolsintrusion-detectionlog-analysis+1
18.4k16h 54m ago
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
evilsocket/opensnitchInteractive GNU/Linux application firewall that filters outbound connections, blocks ads and malware domains, manages system firewall rules via GUI,…
ossec/ossec-hidsOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…
crowdsecurity/crowdsecOpen-source IDS/IPS and WAF engine that analyzes logs and HTTP requests to detect and block malicious IPs, leveraging a crowdsourced community…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
baidu/openraspRuntime application self-protection engine that hooks into application servers to monitor and block malicious database queries, file operations, and…
bytedance/elkeidElkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It…
digitalruby/ipbanAutomated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…
pedramamini/threatingestorAutomated threat intelligence aggregation tool that extracts and normalizes indicators from multiple sources (OSINT feeds, malware reports) into a…
securityclaw/securityclawA modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…
teler-sh/teler-wafteler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets,…
alperenugurlu/network_assessmentWith Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you…
andreicscs/honeywireOpen-source deception platform that turns any Linux machine into a high-signal canary. Deploy tripwire sensors on files, ports, and network services…
alloysecuregroup/phantomfsWindows honeypot using ProjFS to project decoy files that trigger Event Log and desktop alerts when accessed, with SMB remote session logging for…
kube-tarian/tarianeBPF-based runtime security agent for Kubernetes that detects unknown processes and file changes, enforces pre-registered constraints, and automates…
nccgroup/mimikatz-detector-condrvThe Console Monitor Driver is a KMDF kernel-mode filter driver that captures certain Fast I/O operations (input and output) that is sent to or from…
jay123anta/laravel-threat-detectionPassive Laravel middleware that detects and logs SQL injection, XSS, RCE, bot scanners, and 175+ attack patterns. Features a built-in dashboard,…
hullabrian/eventhorizonTool that gathers a customizable set of ETW telemetry and generates user-defined detections