Defensive Security Monitoring

wazuh

by wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

sigma

by SigmaHQ

Main Sigma Rule Repository

graylog2-server

by Graylog2

Free and open log management

AiSOC

by beenuar

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs…

Digital-Forensics-Guide

by mikeroyal

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

RedELK

by outflanknl

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

VictoriaLogs

by VictoriaMetrics

Fast and easy to use database for logs, which can efficiently handle terabytes of logs

elastdocker

by sherifabdlnaby

🐳 Elastic Stack (ELK) v9+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.

awesome-lists

by mthcht

Awesome Security lists for SOC/CERT/CTI

awesome-soc

by cyb3rxp

A curated knowledge base to build, run and mature a SOC (including CSIRT).

matano

by matanolabs

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

Clear-NDR-ISO

by StamusNetworks

A Suricata based NDR distribution

agentic-soc-platform

by FunnyWolf

Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)

pfelk

by pfelk

pfSense/OPNsense + Elastic Stack

Open-Source-Security-Guide

by mikeroyal

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

kunai

by kunai-project

Threat-hunting tool for Linux

sentinel-attack

by edoardogerosa

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

ElectricEye

by jonrau1

ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations…

security-apis

by jaegeral

A collective list of public APIs for use in security. Contributions welcome

Event-Forwarding-Guidance

by nsacyber

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

laurel

by threathunters-io

Transform Linux Audit logs for SIEM usage

tenzir

by tenzir

Tenzir is the data pipeline engine for security teams.

SIEM

by TonyPhipps

SIEM Tactics, Techiques, and Procedures

pql

by runreveal

Pipelined Query Language

Snitch

by aixisstudio

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel…

ThreatHunting-Keywords

by mthcht

Awesome list of keywords and artifacts for Threat Hunting sessions

PurpleCloud

by iknowjason

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

EVTX-to-MITRE-Attack

by mdecrevoisier

Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

UTMStack

by utmstack

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

tailpipe

by turbot

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

CyberBlue

by cyberblu3s

CyberSecurity BLUE TEAM containerized platform that brings together open-source tools for SIEM, DFIR, CTI, SOAR, and Network Analysis

rustinel

by Karib0u

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

OpenUBA

by GACWR

A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from…

xcyclopedia

by strontic

Encyclopedia for Executables

Meerkat

by TonyPhipps

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

panther-analysis

by panther-labs

Built-in Panther detection rules and policies

dsiem

by defenxor

Security event correlation engine for ELK stack

vigil

by Vigil-SOC

Vigil SOC: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.

agentic-threat-hunting-framework

by Nebulock-Inc

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

ATTACKdatamap

by olafhartong

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

threathunting-spl

by inodee

Splunk code (SPL) for serious threat hunters and detection engineers.

MalwLess

by n0dec

Test Blue Team detections without running any attack.

Microsoft-Sentinel-SecOps

by eshlomo1

Microsoft Sentinel SOC Operations

Wazuh-MCP-Server

by gensecaihq

Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001)…

artex-ko-plus

by bdg9412

ARTEX 한국어판 ·AI 기반 침해사고 대응 기능 추가 (upstream: Autumn-27/ARTEX, AGPL-3.0)

mcp-server-wazuh

by gbrigandi

MCP Server for Wazuh SIEM

xnumon

by droe

monitor macOS for malicious activity

sagan

by beave

** README ** This repo has MOVED to https://github.com/quadrantsec/sagan

LogESP

by dogoncouch

Open Source SIEM (Security Information and Event Management system).

blue-teaming-with-kql

by ashwin-patil

Repository with Sample KQL Query examples for Threat Hunting