arkime
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
defensive-toolsdigital-forensicsforensics+7
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
ntop/ntopngWeb-based Traffic and Cybersecurity Network Traffic Monitoring
googlecloudplatform/professional-servicesCollection of Google Cloud solution examples and operational utilities for audit log monitoring, DLP de-identification, encryption key management,…
ossec/ossec-hidsOSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit…
beenuar/aisocSelf-hostable AI SOC that fuses security alerts, auto-triages via agentic AI, runs MITRE ATT&CK investigations, and logs every agent decision in a…
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
0x4d31/awesome-threat-detectionCurated list of threat detection and hunting resources: detection rules, SIEM and log analysis tools, endpoint/network monitoring, datasets,…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
elastic/detection-rulesDevelop, validate, and publish SIEM detection rules for Elastic Security, with Python CLI tooling, KQL parsing, Kibana integration, and packaged…
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
cyb3rxp/awesome-socA curated knowledge base to build, run and mature a SOC (including CSIRT).
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
withsecureopensource/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
thinkst/opencanaryLow-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.