Sentora
d3vhex/sentoraAn open-source, self-hosted AI-powered SIEM, EDR and SOAR platform for modern security operations.
ai-securityincident-responseintrusion-detection+3
6
d3vhex/sentoraAn open-source, self-hosted AI-powered SIEM, EDR and SOAR platform for modern security operations.
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
beenuar/aisocOpen-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation.…
nate-ryan-7690/home_soc_suiteA personal Windows SOC suite built in PowerShell — monitors network connections, resource usage, scheduled tasks and power events with severity…
zedocun/sharepoint-cve-2023-29375-incident-responseEnd-to-end SOC incident analysis and threat hunting playbook targeting Microsoft SharePoint privilege escalation (CVE-2023-29375) using SIEM logs,…
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
itzmeshervin/siem-dashboardA lightweight, real-time Security Information and Event Management (SIEM) dashboard built using Streamlit. It collects system logs, detects USB and…
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
mthcht/purpleteamPurpleteam scripts simulation & Detection - trigger events for SOC detections
cross-samuel1/soc-analyst-hubFree, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…
ernestak/sigma-rule-for-cve-2022-30190Sigma rule for detecting exploitation of CVE-2022-30190 (Follina) via Windows process creation events, enabling SOC teams to identify malicious…
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
mthcht/threathunting-keywordsAwesome list of keywords and artifacts for Threat Hunting sessions
swimlane/soc-fakerA python package for use in generating fake data for SOC and security automation.
letsdefend/awesome-soc-analystUseful resources for SOC Analyst and SOC Analyst candidates.
safelineman/agentic-soc-simulationAI 驱动的 SOC 仿真平台
ashok523/cve-2026-31431Defensive IR playbook and detection package for CVE-2026-31431 (Copy Fail) Linux kernel LPE, including Sigma, auditd, Falco, Wazuh, YARA, eBPF, and…
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…