tirreno
tirrenotechnologies/tirrenoOpen-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks,…
anomaly-detectionanti-botapi-security+3
tirrenotechnologies/tirrenoOpen-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks,…
hubblestack/hubbleHubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
linux-audit/audit-kernelGitHub mirror of the Linux Kernel's audit repository
cred-club/artifAn advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.
owasp/python-honeypotOWASP Honeypot, Automated Deception Framework.
dereeqw/berrysentinelBerry Sentinel v5.0 — Advanced behavioral C2 and reverse shell detector for Linux/Windows/Unix systems. Features real-time connection analysis,…
usarmyresearchlab/dshellDshell is a network forensic analysis framework.
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
invictus-ir/alfaAutomated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…
jamf/aftermathSwift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…
hashicorp-forge/groveA Software as a Service (SaaS) log collection framework.
adversarial-detection-engineering/adversarial-detection-engineering-frameworkA framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concrete examples…
corelight/icanntldZeek script using the official ICANN Top-Level Domain (TLD) list with the Input Framework to extract the relevant information from a DNS query and…
corelight/c2-detection-manjusakaDetection of Manjusaka C2 framework
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
cyb3r-monk/rita-jImplementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.
kacos2000/evtx_log_browserEvtx Log (xml) Browser