tenzir
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
incident-responselog-analysisnetwork-security+1
756
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
hashicorp-forge/groveA Software as a Service (SaaS) log collection framework.
olafhartong/sysmon-modularA repository of sysmon configuration modules
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
honeylabshq/spip-goSpip network sensor written in Go
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
lukehebe/kql-hunting_and_detection-queriesSome of my KQL hunting queries
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
lethal-forensics/macos-collectormacos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
xephora/threat-remediation-scriptsThis repository contains a list of new remediation scripts.
mrrawbit/sonicwall-sma1000-zero-day-ioc-checkUnofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.
hybridbrothers/hunting-queries-detection-rulesThe purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious…
corelight/extendintelThis package extends the Intel package to log more fields
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.