arkime
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
defensive-toolsdigital-forensicsforensics+7
7.5k
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
mgeeky/decode-spam-headersA script that helps you understand why your E-Mail ended up in Spam
kvasirsecurity/kvasirKvasir: Penetration Test Data Management
fenkohq/dnsmonsterPassive DNS Capture and Monitoring Toolkit
owasp/securetea-projectThe OWASP SecureTea Project provides a one-stop security solution for various devices (personal computers / servers / IoT devices)
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
eshlomo1/microsoft-sentinel-secopsSOC operations content for Microsoft Sentinel, including hunting queries, incident response playbooks, and security event analysis for Azure cloud…
jepaynemsft/wefflesBuild a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
sigmahq/sigma-cliThe Sigma command line interface based on pySigma
abdulrhmanalfaifi/fennecArtifact collection tool for *nix systems
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
trinitor/cve-vulnerability-information-downloaderDownloads and aggregates CVSS, EPSS, and CISA known exploited vulnerability data into unified JSON/CSV files and a SQLite database. Enriches…
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
randomuserid/tyliumPrimary data pipelines for intrusion detection, security analytics and threat hunting
keyboardcrunch/sentinelone-attack-queriesMITRE ATT&CK mapped queries for SentinelOne Deep Visiblity