Azure-Sentinel
azure/azure-sentinelCloud-native SIEM for intelligent security analytics for your entire enterprise.
cloud-securitycurated-resourcesdefensive-tools+5
6.1k
azure/azure-sentinelCloud-native SIEM for intelligent security analytics for your entire enterprise.
ossec/ossec-hidsOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…
grafana/lokiHorizontally scalable, multi-tenant log aggregation system that indexes labels instead of full text, integrates with Grafana, and is optimized for…
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
elastic/detection-rulesDevelop, validate, and publish SIEM detection rules for Elastic Security, with Python CLI tooling, KQL parsing, Kibana integration, and packaged…
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
phpboyscout/go/redactStrip credential-like content from free-form strings before they reach logs or telemetry. Part of the phpboyscout Go toolkit. ·…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
omerbenamram/evtxA Fast (and safe) parser for the Windows XML Event Log (EVTX) format
beenuar/aisocSelf-hostable AI SOC that fuses security alerts, auto-triages via agentic AI, runs MITRE ATT&CK investigations, and logs every agent decision in a…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
ntop/ntopngWeb-based Traffic and Cybersecurity Network Traffic Monitoring
graylog2/graylog2-serverCentralized log management platform for collecting, indexing, and analyzing streaming logs, with alerting and event correlation for security…
domcyrus/rustnetPer-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
cisco-ai-defense/defenseclawSecurity Governance for Agentic AI