packetStrider
benjeems/packetstriderA network packet forensics tool for SSH
anomaly-detectionforensicsintrusion-detection+5
255
benjeems/packetstriderA network packet forensics tool for SSH
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
insane-forensics/drovorub-huntA tool to assist with network-based hunting for GRU's Drovorub malware c2
packetsifter/packetsiftertoolPacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…
halildeniz/networkassessmentNetworkAssessment: Network Compromise Assessment Tool
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
security-onion-solutions/security-onionSecurity Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
oisf/suricataOpen-source network IDS/IPS/NSM engine for real-time traffic inspection, intrusion detection and prevention, protocol analysis, and rule-based threat…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
stamparm/maltrailReal-time malicious traffic detection system using public blacklists, static malware trails, and heuristic analysis to identify threats across DNS,…
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
corelight/zeek-netsupport-detectorA Zeek based NetSupport detector. NetSupport is often abused by attackers in malware.
camp0/aiengineAIEngine is a next generation interactive/programmable Python/Ruby/Java/Lua and Go NIDS (Network intrusion detection system).
corelight/corelightforsplunkSplunk app for integrating and analyzing Corelight network detection data, enabling real-time threat hunting and incident response.
cyb3r-monk/rita-jImplementation of RITA (Real Intelligence Threat Analytics) in Jupyter Notebook with improved scoring algorithm.
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
cisco/joyA package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.