googlecloudplatform/professional-servicesCollection of Google Cloud solution examples and operational utilities for audit log monitoring, DLP de-identification, encryption key management,…
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
grafana/lokiHorizontally scalable, multi-tenant log aggregation system that indexes labels instead of full text, integrates with Grafana, and is optimized for…
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
fenkohq/dnsmonsterPassive DNS Capture and Monitoring Toolkit
sigmahq/sigma-cliThe Sigma command line interface based on pySigma
jev-sec/jev-idsBlazing-Fast Token-Efficient Intrusion Detection System (IDS) based on TypeSafe's Jev.
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
owasp-modsecurity/modsecurityModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based…
bert-janp/entratraceDefensive research tool that documents observable API endpoints and user agents of offensive tooling targeting Microsoft Entra ID, supporting…
log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
a2awais/threat-huntingCurated collection of threat hunting and detection queries for CrowdStrike Falcon (CQL) and Microsoft Defender XDR (KQL), mapped to MITRE ATT&CK…
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
tsale/edr-telemetryThis project aims to compare and evaluate the telemetry of various EDR products.
rorywag/hayabusa-bulk-runnerBulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard
dougburks/so-cratesSO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
abdaullahag/threatlensPython CLI tool for rapid IOC analysis (IPs, Domains, CVEs) using 6 free Threat Intel APIs. Outputs: Color-coded Excel, JSON, CSV. Uses: VT, Shodan,…
