DShield-SIEM

DShield Sensor Log Collection with Elasticsearch Introduction This is fork and a significant update from the initial publication on the ISC Storm Center website by Scott Jensen as a BACS paper and the scripts published in Github. https://github.com/fkadriver/Dshield-ELK...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

psad

psad - Intrusion Detection with iptables Logs Introduction The Port Scan Attack Detector psad is a lightweight system daemon written in is designed to work with Linux iptables/ip6tables/firewalld firewalling code to detect suspicious traffic such as port scans and sweeps, backdoors, botnet comman...

dshield

DShield DShield Sensor This is a set of scripts to set up a DShield Sensor. Current design goals and prerequisites for using the automated installation procedure: use of a dedicated device Raspberry Pi 3 or later, n100 mini PC or a virtual machine work fine minimum of 1GB of RAM and 16GB of Disk ...

Port Scan Attack Detector: PSAD

Port Scan Attack Detector The Port Scan Attack Detector psad is a lightweight system daemon written in is designed to work with Linux iptables/ip6tables/firewalld firewalling code to detect suspicious traffic such as port scans and sweeps, backdoors, botnet command and control communications, and...

Malicious Host Intelligence: hostintel

Malicious Host Intelligence This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. Th...

DEBIAN-CVE-2009-5023

The 1 dshield.conf, 2 mail-buffered.conf, 3 mynetwatchman.conf, and 4 mynetwatchman.conf actions in action.d/ in Fail2ban before 0.8.5 allows local users to write to arbitrary files via a symlink attack on temporary files with predictable names, as demonstrated by /tmp/fail2ban-mail.txt...

SmartDefense DShield Storm Center: Share Malicious IP Addresses with Other Organizations

Storm Centers collect logging information about attacks, provided voluntarily by organization from all around the world. Storm Centers compare and present reports on real-time threats to network security. The SmartDefense Storm Center Module enables information flow between the network Storm...