meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
graylog2/graylog2-serverCentralized log management platform for collecting, indexing, and analyzing streaming logs, with alerting and event correlation for security…
googlecloudplatform/professional-servicesCollection of Google Cloud solution examples and operational utilities for audit log monitoring, DLP de-identification, encryption key management,…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
foru17/neko-masterA modern and elegant dashboard for network traffic visualization and analysis.
cyb3rmik3/kql-threat-hunting-queriesA repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
otrf/ossemCommunity-driven project for documenting, standardizing, and modeling security event logs to improve detection analytics and data normalization…
kunai-project/kunaieBPF-based Linux security monitor and threat hunter providing chronologically ordered, container-aware events with on-host correlation for incident…
omerbenamram/evtxA Fast (and safe) parser for the Windows XML Event Log (EVTX) format
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
letsdefend/awesome-soc-analystUseful resources for SOC Analyst and SOC Analyst candidates.
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
logpresso/cve-2021-44228-scannerVulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
d3vl/l3monWeb-based network monitoring system providing real-time bandwidth tracking, server performance metrics, and customizable alerts for proactive network…
randomuserid/adamaSearches For Threat Hunting and Security Analytics
