
tenzir
Collect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…

Collect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…

Curated IPv4 blocklist of malicious addresses, refreshed every 6 hours for firewall and WAF ingestion, with split lists and CTI-ready formats for…

Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/

Spip network sensor written in Go

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

Very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support

Multiplatform C++ library for high-performance network packet capture, parsing, crafting, and analysis. Supports libpcap, DPDK, AF_XDP, PF_RING, and…

Automatically generated C2 threat intelligence feeds of IPs, domains, URL paths, and implant configuration metadata, derived from internet scanning…

Mapping Corelight or Zeek data to Elastic Common Schema logs

Curated macOS security and privacy guide with practical instructions for threat modeling, disk encryption, firewall configuration, secure…

The best-in-class macOS app to See every packet clearly on your Mac. Alternative to Wireshark

A network sniffer that logs all DNS server replies for use in a passive DNS setup

High-interaction OPC UA honeypot for ICS/SCADA — multi-profile (oil & gas, water, power grid), live process simulation, per-session threat scoring,…

MikroTik RouterOS PoC Collection - CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH

Installs and configures a DShield honeypot sensor on Raspberry Pi or Ubuntu, running Cowrie SSH and HTTP honeypots and forwarding firewall logs to…

Forensic triage toolkit for Citrix NetScaler devices, featuring a Dissect-based IOC scanner for webshells, timestomping, and suspicious binaries,…

Cisco IOS XE implant scanning & detection (CVE-2023-20198, CVE-2023-20273)

Adaptive two-stage Layer 4 DDoS mitigation gateway using behavioral traffic analysis, Random Forest classification, and kernel-level ipset/iptables…