RedELK
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
defensive-toolsincident-responseinformation-gathering+4
2.7k
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
alb-uss/secmonAutomated infosec watching and vulnerability management tool with CVE polling, CPE-based matching, exploit search, RSS threat feed aggregation, and…
jangeisbauer/gundogPowerShell-based guided hunting tool for Microsoft 365 Defender that automates alert triage, entity enrichment, and IOC lookups across email and…
flo354/iosforensicPython tool for iOS forensic analysis that extracts files, logs, SQLite databases, and decompresses .plist files from jailbroken devices via SSH.
teycir/diffcatcherA Rust CLI tool that recursively discovers Git repositories, captures state changes, generates diffs, extracts code elements with full snippets, and…
ab2pentest/macosthreattrackBash tool used for proactive detection of malicious activity on macOS systems.
corelight/zeek-endpoint-enrichmentZeek log enrichment tool that adds host information and known entity references to enhance network security monitoring and incident response.
rootly-ai-labs/rootly-graphify-importerTurn Rootly incidents, alerts, and teams into a queryable knowledge graph. Visualize service dependencies, on-call coverage gaps, and cross-incident…
corelight/zeek-openvpnZeek plugin for detecting and parsing OpenVPN traffic (UDP/TCP with TLS), extracting session and TLS handshake metadata for network security…
tg12/dns-honeypotPassive DNS honeypot that captures unsolicited queries using Unbound, Loki, Prometheus, and Grafana. Logs client IPs, queried domains, and throughput…
corelight/top-dnsProbabilistic measurement script for Bro/Zeek that tracks top DNS queries by type over configurable intervals, logging results to a dedicated log for…
honeylabshq/spip-goLightweight low-interaction network honeypot sensor that captures TCP payloads, performs passive TLS/HTTP/SSH fingerprinting, and outputs structured…
k11h-de/bbot-uiTerminal UI for browsing, annotating, and analyzing BBOT reconnaissance scan results with live refresh, vulnerability tracking, and hierarchical…
intel-xeon/cve-2021-44228---detection-with-powershellPowerShell-based scanner to detect Log4j CVE-2021-44228 vulnerability by searching directories and log files for exploitation indicators.
kolya5544/bearftpHoneypot FTP server written in .NET Core (C#) for both Linux and Windows.
corelight/icanntldZeek script that enriches DNS logs with ICANN TLD, domain, and subdomain fields, and marks trusted domains for threat detection.
tnich/honsshSSH honeypot proxy that logs all client-server communications for capturing attacker interactions and session data in high-interaction honeypot…
cred-club/artifAn advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.