

Audit only eBPF EDR for Linux 5.15+ LTS: 14 kernel hooks, 15 actions (13 MITRE techniques), process lineage, SIEM export, K8s/Docker ready.

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity

Maliciousness scoring for Linux commands

Audix is a PowerShell tool to quickly configure the Windows Event Audit Policies for security monitoring

EXIST is a web application for aggregating and analyzing cyber threat intelligence.

Centralize Management of Intrusion Detection System like Suricata Bro Ossec ...

Real-time HTTP Intrusion Detection

Easy-to-use live forensics toolbox for Linux endpoints

Sigma-based detection rules, log queries, atomic tests, and response procedures for monitoring and threat hunting in GitLab environments.

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management


HonSSH is designed to log all SSH communications between a client and server.

Dockerized honeypot for CVE-2021-44228.

Look for un-sinkholed C&C IPs in your Bro logs (from Bambanek Consulting C&C master list)

Medium-interaction SSH honeypot that logs brute force attacks and full attacker shell interactions, with customization options to reduce…