LinuxCatScale

نص جمع CatScale للاستجابة للحوادث في لينكس Linux CatScale هو نص bash يستخدم أدوات موجودة مسبقاً في النظام لجمع بيانات شاملة من المضيفات المستندة إلى لينكس. تهدف البيانات إلى مساعدة محترفي التحقيق الرقمي والاستجابة للحوادث في فرز الحوادث وتحديد نطاقها. كما تم تكوين مثيل من ELK Stack لاستهلاك...

DetectionLabELK

DetectionLabELK DetectionLabELK هو فرع من DetectionLab الخاص بـ Chris Long مع مجموعة ELK بدلاً من Splunk. الوصف: DetectionLabELK هو المختبر المثالي للاستخدام إذا كنت ترغب في بناء قدرات كشف فعالة. لقد تم تصميمه مع وضع المدافعين في الاعتبار. غرضه الأساسي هو السماح للفرق الزرقاء ببناء نطاق Windows...

HELK

HELK Hunting ELK, 또는 간단히 HELK는 SQL 선언적 언어, 그래프, 구조적 스트리밍, 그리고 Jupyter 노트북과 Apache Spark를 통한 머신러닝까지 고급 분석 기능을 갖춘 최초의 오픈 소스 헌트 플랫폼 중 하나입니다. 이 프로젝트는 주로 연구 목적으로 개발되었지만, 유연한 설계와 핵심 구성 요소 덕분에 적절한 구성과 확장 가능한 인프라를 갖춘 대규모 환경에도 배포할 수 있습니다. 목표 커뮤니티에 오픈 소스 헌팅 플랫폼을 제공하고 위협 헌팅의 기본을 공유합니다. 헌트 플랫폼 배포 시간을 단축합니다. ...

dsiem

Dsiem ديسيم هو محرك ارتباط أحداث أمنية لـ ELK stack، مما يسمح باستخدام المنصة كنظام SIEM مخصص ومتكامل الميزات. يوفر ديسيم ارتباطًا على غرار OSSIM للأحداث / السجلات الموحدة، ويقوم بإجراء بحث / استعلام عن مصادر معلومات الاستخبارات التهديدية ونقاط الضعف، وينتج إنذارات معدلة حسب المخاطر. الميزات يعمل...

atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

DShield-SIEM

DShield Sensor Log Collection with Elasticsearch Введение Это форк и значительное обновление первоначальной публикации на сайте ISC Storm Center, автором которой является Скотт Дженсен Scott Jensen, в виде статьи BACS и скриптов, опубликованных на Github. https://github.com/fkadriver/Dshield-ELK...

tsharkVM

💡 تحديث: tshark-opensearch التطبيق الأحدث tshark-opensearch متوفر الآن. يمكنك العثور عليه في مستودع https://github.com/h21-lab/apps-collection-info. 👉 احصل على الوصول جهاز tshark ELK VM الظاهري يبني هذا المشروع آلة افتراضية يمكن استخدامها لتحليل مخرجات tshark -T ek ndjson. يتم بناء الجهاز الظاهري...

gaia

Gaia: المُقيِّم العالمي لسلامة واجهات برمجة التطبيقات التبعيات قم بتثبيت opam لبناء واجهة برمجة تطبيقات الاختبارات. قم بتثبيت git و python3 و pip و .NET لبناء RESTler و Schemathesis. قم بتثبيت cargo لبناء Gaia. قم بتثبيت docker v26.0.1 و docker compose v2.26.1 لبناء Gaia مع مكدس ELK اختياري إن لم...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk

DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to...

LinuxCatScale - Incident Response Collection And Processing Scripts With Automated Reporting Scripts

Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process. Usage This script...

tsharkVM - Tshark + ELK Analytics Virtual Machine

This project builds virtual machine which can be used for analytics of tshark -T ek ndjson output. The virtual appliance is built using vagrant, which builds Debian 10 with pre-installed and pre-configured ELK stack. After the VM is up, the process is simple: decoded pcaps tshark -T ek output /...

Bughound - Static Code Analysis Tool Based On Elasticsearch

Bughound is an open-source static code analysis tool that analyzes your code and sends the results to Elasticsearch and Kibana to get useful insights about the potential vulnerabilities in your code. Bughound has its own Elasticsearch and Kibana Docker image that is preconfigured with dashboards ...

HELK - The Hunting ELK

The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed...

HELK: one with the advanced analysis capabilities of vulnerability discovery platform-vulnerability warning-the black bar safety net

Today to introduce to you is a guy named HELK a tool, it is a superior analytical capability of Hunting ELK（Elasticsearch, Logstash, Kibana is. ! Target 1. To the security community to provide a free vulnerability Hunting platform, and shared some basic security threats and vulnerability discover...

Multi-Honeypot Platform: T-Pot

Multi-Honeypot Platform T-Pot is based on Ubuntu Server 16.10 LTS. The honeypot daemons as well as other support components being used have been paravirtualized using docker . This allowed developers to run multiple honeypot daemons on the same network interface without problems and make the enti...

HoneyDrive 3 - The Premier Honeypot Linux Distro

HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance OVA with Xubuntu Desktop 12.04.4 LTS edition installed. It contains over 10 pre-installed and pre-configured honeypot software packages such as Kippo SSH honeypot, Dionaea and Amun malware honeypots, Honeyd low-interaction...

Honeypot Linux Distro: HoneyDrive

HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance OVA with Xubuntu Desktop 12.04.4 LTS edition installed. It contains over 10 pre-installed and pre-configured honeypot software packages such as Kippo SSH honeypot, Dionaea and Amun malware honeypots, Honeyd low-interaction...