Archived
mandiant/mandiant-azure-ad-investigator
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
matanolabs/matanoOpen source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
jepaynemsft/wefflesBuild a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
jangeisbauer/gundoggundog - guided hunting in Microsoft Defender
zephrfish/cve-2025-53770-scannerToolShell scanner - CVE-2025-53770 and detection information
nccgroup/impossibletravelloganalysisBasic log analysis tool to detect impossible travel via IP address geographic information
rnb-team/loghoundPost-Exploitation EVTX Analyzer for BloodHound Mapping
honeylabshq/spip-goSpip network sensor written in Go
corelight/extendintelThis package extends the Intel package to log more fields