ntopng
ntop/ntopngWeb-based Traffic and Cybersecurity Network Traffic Monitoring
anomaly-detectiondns-analysisintrusion-detection+6
ntop/ntopngWeb-based Traffic and Cybersecurity Network Traffic Monitoring
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
fail2ban/fail2banDaemon to ban hosts that cause multiple authentication errors
wazuh/wazuhOpen-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…
cowrie/cowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
josevnz/suricatalogParse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…
datadog/hashYAML-configurable low-interactive honeypot framework for deploying HTTP/HTTPS-based deception servers with built-in honeytraps and Datadog log…
duggytuxy/syswardenHost-local Linux security orchestrator enforcing nftables policy with HIDS/HIPS telemetry, bounded threat-intelligence feeds, out-of-band WAAP log…
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs
corelight/ecs-templatesCorelight or Zeek Elastic Common Schema Templates
corelight/ecs-mappingMapping Corelight or Zeek data to Elastic Common Schema fields
thinkst/opencanaryLow-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…
sonitbahl/sshintelSelf-contained SSH honeypot for capturing attacker interactions and turning them into structured security intelligence.
matthart1983/esshEnhanced SSH client with TUI — manage connections, keys, and sessions
thelightscope/thelightscopeTheLightScope
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…