galah
0x4d31/galahGalah: An LLM-powered web honeypot.
incident-responseintrusion-detectionthreat-intelligence+1
0x4d31/galahGalah: An LLM-powered web honeypot.
teler-sh/teler-wafteler-waf is a Go HTTP middleware that protects local web services from OWASP Top 10 threats, known vulnerabilities, malicious actors, botnets,…
khoinp1012/kprotectKernel-level security engine using eBPF-LSM to enforce file access policies based on process lineage, protecting sensitive data from supply-chain…
kouf320/docker-lab-cve-2017-5638-cve-2021-41773Docker-based multi-stage attack emulation lab demonstrating CVE-2017-5638 and CVE-2021-41773 exploitation, lateral movement, and Suricata IDS…
ait-aecid/logdata-anomaly-minerThis tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources…
withsecurelabs/lazarus-sigma-rulesSigma rules for detecting Lazarus Group TTPs, covering malicious document execution, PowerShell abuse, scheduled tasks, and credential access,…
nsol-nmsu/fml-networkFLNET2023 is a dataset designed for intrusion detection in Federated Learning scenarios. It's built using the CORE emulator, simulating a realistic…
mr-r3b00t/cve-2026-0300Deceptive honeypot designed to simulate and monitor exploitation attempts targeting CVE-2026-0300, capturing attacker behavior for analysis and…
thrandomv/cve-2026-31431-detectionDefensive detection package for CVE-2026-31431 (Linux kernel AF_ALG LPE). Sigma, Falco, auditd, KQL, and EQL rules mapped to MITRE ATT&CK…
itzmeshervin/siem-dashboardA lightweight, real-time Security Information and Event Management (SIEM) dashboard built using Streamlit. It collects system logs, detects USB and…
lopqto/cve-2021-41773_honeypotLightweight honeypot for Apache HTTP Server path traversal vulnerability CVE-2021-41773, designed to capture and log exploitation attempts.
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
neo23x0/auditdBest Practice Auditd Configuration
nfstream/nfstreamNFStream: a Flexible Network Data Analysis Framework.
srlabs/certiceptionAn ADCS honeypot to catch attackers in your internal network.
andreicscs/honeywireOpen-source deception platform that turns any Linux machine into a high-signal canary. Deploy tripwire sensors on files, ports, and network services…
halildeniz/networkassessmentNetworkAssessment: Network Compromise Assessment Tool
c3rb3ru5d3d53c/signaturesCommunity Detection Signature Build and Distribution Pipeline for YARA, Suricata, Snort and Sigma