Tools

pavel-odintsov/fastnetmon

Very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support

purp1ew0lf/blue-team-notes

You didn't think I'd go and leave the blue team out, right?

pi-hole/web

Pi-hole Dashboard for stats and more

cyb3rward0g/helk

The Hunting ELK

neo23x0/auditd

Best Practice Auditd Configuration

otrf/ossem

Community-driven project for documenting, standardizing, and modeling security event logs to improve detection analytics and data normalization…

seccubus/seccubus

Easy automated vulnerability scanning, reporting and analysis

scarredmonk/sysmonsimulator

Sysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…

securityjoes/masterparser

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

activecm/rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

hashicorp-forge/grove

A Software as a Service (SaaS) log collection framework.

nextronsystems/sysmon-config

Sysmon configuration file template with default high-quality event tracing

owasp/honeypot-project

Deploy web honeypots to capture emerging attack data, analyze ModSecurity audit logs via ELK, and share threat intelligence with MISP for…

orlikoski/skadi

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

op7ic/blueteam.lab

Blue Team detection lab created with Terraform and Ansible in Azure.

mitre/brawl-public-game-001

Data from a BRAWL Automated Adversary Emulation Exercise

ox-eye/ox4shell

Deobfuscate Log4Shell payloads with ease.

corelight/community-id-spec

An open standard for hashing network flows into identifiers, a.k.a "Community IDs".