pySigma
sigmahq/pysigmaPython library to parse and convert Sigma rules into queries (and whatever else you could imagine)
defensive-toolsintrusion-detectionlog-analysis+2
597
sigmahq/pysigmaPython library to parse and convert Sigma rules into queries (and whatever else you could imagine)
grafana/lokiHorizontally scalable, multi-tenant log aggregation system that indexes labels instead of full text, integrates with Grafana, and is optimized for…
lore-hex/quill-routerTrustedRouter.com repo for secure LLM proxying
bert-janp/entratraceDefensive research tool that documents observable API endpoints and user agents of offensive tooling targeting Microsoft Entra ID, supporting…
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
ahmedkhlief/apt-hunterAPT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…
runewardd/runewardGoverned execution cells for AI agents.
yamato-security/welaAudits Windows event log settings against best-practice guidelines and Sigma-rule detectability, with automated configuration for DFIR readiness.
allinurl/goaccessGoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.
abdaullahag/threatlensPython CLI tool for rapid IOC analysis (IPs, Domains, CVEs) using 6 free Threat Intel APIs. Outputs: Color-coded Excel, JSON, CSV. Uses: VT, Shodan,…
matthart1983/esshEnhanced SSH client with TUI — manage connections, keys, and sessions
adarsh14734/aegis-releasesSandbox and MCP proxy that blocks AI coding agents from reading SSH keys, AWS credentials, and .env files, with deny-by-default policy and…
ekitji/siemCurated SIEM queries and techniques for offensive discovery of Windows privilege escalation, misconfigured ACLs, services, scheduled tasks, and…
juanlunaia/aegis-latent-coreAI governance and evidence gateway for multi-provider LLM applications. FastAPI + optional Rust core for policy, WAF, egress, rate limits, sessions,…
canyonroad/agentshExecution-Layer Security (ELS) for AI agents — policy-enforced shell with audit.
philippeabraxas-jpg/responsible-alliance-protocolSafety cannot be a prompt instruction. TBP provides an external execution-layer boundary for autonomous agents, enforcing hard F/I/W invariants via…
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
kerlenton/mcpsnoopWireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal.