
zeek-community-id
Zeek support for Community ID flow hashing.

Zeek support for Community ID flow hashing.

Corelight Dashboards and Parsers for Sentinel One Singularity

Daemon to ban hosts that cause multiple authentication errors


Very fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support


Automated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…


Collect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…

Easy automated vulnerability scanning, reporting and analysis

A wireshark plugin to instrument ETW

DECeption with Evaluative Integrated Validation Engine (DECEIVE): Let an LLM do all the hard honeypot work!

A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.

Flows-first PCAP TUI (case files, gorgeous UX). Do do do do.

DShield Sensor Log Collection with ELK

Enhanced SSH client with TUI — manage connections, keys, and sessions

Mapping Corelight or Zeek data to Elastic Common Schema fields

Corelight@Home script