atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

Adama

Adama Searches For Threat Hunting and Security Analytics A collection of known log and / or event data searches for threat hunting and detection. They enumerate sets of searches used across many different data pipelines. Implementation details are for ELK. Adama is part of the SpaceCake project...

HELK

HELK The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was...

gaia

Gaia: Global API Integrity Assessor Dependencies Install opam to build the tests API. Install git, python3, pip and .NET to build RESTler and Schemathesis. Install cargo to build Gaia. Install docker v26.0.1 and docker compose v2.26.1 to build Gaia with the ELK Stack optionnal if not. Install nod...

DetectionLabELK

DetectionLabELK DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to all...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

tsharkVM

💡 Update: tshark-opensearch More recent application tshark-opensearch is now available. You can find it in the https://github.com/h21-lab/apps-collection-info repository. 👉 Get Access tshark ELK VM appliance This project builds virtual machine which can be used for analytics of tshark -T ek ndjso...

DShield-SIEM

DShield Sensor Log Collection with Elasticsearch Introduction This is fork and a significant update from the initial publication on the ISC Storm Center website by Scott Jensen as a BACS paper and the scripts published in Github. https://github.com/fkadriver/Dshield-ELK...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

LinuxCatScale

Linux-CatScale IR Collection Script Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the...

whids

IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...

dsiem

Dsiem Dsiem es un motor de correlación de eventos de seguridad para ELK stack, que permite que la plataforma se utilice como un sistema SIEM dedicado y completo. Dsiem proporciona correlación al estilo OSSIM para registros/eventos normalizados, realiza consultas a fuentes de inteligencia de...

graal (>=0.3.2rc1, <=0.3.2rc2), grimoire-elk (>=0.103.0rc1, <=0.103.0rc3) potentially affected by CVE-2026-114094 via dulwich (0.20.42)

dulwich PYPI version 0.20.42 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - graal =0.3.2rc1, =0.103.0rc1, =0.103.0rc3 Source cves: CVE-2026-114094 Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

graal (>=0.3.2rc3, <=0.4.1rc3), grimoire-elk (>=0.103.0rc10, <=0.103.2rc2) +8 more potentially affected by CVE-2026-114094 via dulwich (0.20.46)

dulwich PYPI version 0.20.46 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - graal =0.3.2rc3, =0.103.0rc10, =0.6.0, =0.2.2rc4, =0.20.0rc6, =0.3.2rc4, =0.2.2rc4, =0.2.2rc4, =0.2.2rc5, =0.4.0rc1, =0.5.0rc2 Source cves:...

grimoire-elk (>=0.55.0, <=0.58.0), grimoirelab (>=0.2.52, <=0.2.53) +4 more potentially affected by CVE-2026-114094 via dulwich (0.21.4.1)

dulwich PYPI version 0.21.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - grimoire-elk =0.55.0, =0.2.52, =0.1.0, =0.13.2, =0.4.5, =0.0.4, =0.0.6 Source cves: CVE-2026-114094 Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

graal (>=0.3.2rc1, <=0.3.2rc2), grimoire-elk (>=0.103.0rc1, <=0.103.0rc3) potentially affected by CVE-2026-114095 via dulwich (0.20.42)

dulwich PYPI version 0.20.42 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - graal =0.3.2rc1, =0.103.0rc1, =0.103.0rc3 Source cves: CVE-2026-114095 Source advisory: OSV:GHSA-35MR-4567-66VG...

grimoire-elk (>=0.55.0, <=0.58.0), grimoirelab (>=0.2.52, <=0.2.53) +4 more potentially affected by CVE-2026-114095 via dulwich (0.21.4.1)

dulwich PYPI version 0.21.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - grimoire-elk =0.55.0, =0.2.52, =0.1.0, =0.13.2, =0.4.5, =0.0.4, =0.0.6 Source cves: CVE-2026-114095 Source advisory: OSV:GHSA-35MR-4567-66VG...

graal (>=0.3.2rc3, <=0.4.1rc3), grimoire-elk (>=0.103.0rc10, <=0.103.2rc2) +8 more potentially affected by CVE-2026-114095 via dulwich (0.20.46)

dulwich PYPI version 0.20.46 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - graal =0.3.2rc3, =0.103.0rc10, =0.6.0, =0.2.2rc4, =0.20.0rc6, =0.3.2rc4, =0.2.2rc4, =0.2.2rc4, =0.2.2rc5, =0.4.0rc1, =0.5.0rc2 Source cves:...

Malicious code in immense-brown-elk (npm)

Source: amazon-inspector 90d0bfeba4125eb4c3e9e3ebd23385bc527e264cde1bc42a0b95447f427300bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hot-scarlet-elk (npm)

Source: amazon-inspector 2d5bb7cb7618482e44b942bf72b54ae9819761b2997fe351994960ae0b27787d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...