fail2ban
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
anti-botdefensive-toolsintrusion-detection+2
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
emrekybs/tgsherlockTelegram OSINT tool for user, group and message investigation
wagga40/logstotalSelf-hosted multi-engine Sigma detection for event logs
invictus-ir/alfaAutomated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…
thinkst/opencanaryLow-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…
buybitart/get-the-hackerHunt WiFi threats silently. Catch the hackers.
sonitbahl/sshintelSelf-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.
msuhanov/easy_triageScripts to triage compromised systems (Linux, ESXi, FreeBSD/NetScaler)
olafhartong/sysmon-modularA repository of sysmon configuration modules
ait-aecid/logdata-anomaly-minerThis tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources…
umidguluzada/cyberdefense-labA complete Blue Team Cybersecurity Lab featuring pfSense, Suricata, and ELK Stack for network monitoring and threat detection.
yeet-src/sigwireLive kernel signal observability tool using eBPF tracepoints to stream every signal raised on a Linux host, showing sender, target, disposition,…
1-bit-wonder/kestrelSingle-host runtime-security dashboard on eBPF — Go agent + SvelteKit. Live process tree, network map, and rule-based alerts for plain Linux hosts.
digitalruby/ipbanAutomated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…
cisco-talos/deceiveDECeption with Evaluative Integrated Validation Engine (DECEIVE): Let an LLM do all the hard honeypot work!
formerlab/shadow-fleet-tracker-lightOpen source Baltic Sea shadow fleet tracker. 1200+ vessels, live AIS, cable proximity alerts. No cloud, no subscription, runs locally
la3ar0v/tuxresponseAutomated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.
emrekybs/mrhandlerSSH-based Linux incident response tool that executes diagnostic commands to collect network configs, logs, user accounts, and processes, then…