LinuxCatScale

Script de collecte IR Linux-CatScale Linux CatScale est un script bash qui utilise des outils natifs du système pour collecter des données complètes sur des hôtes Linux. Ces données aident les professionnels du DFIR à trier et à évaluer les incidents. Une instance Elk Stack est également configur...

DetectionLabELK

DetectionLabELK DetectionLabELK est un fork du DetectionLab de Chris Long utilisant la pile ELK à la place de Splunk. Description : DetectionLabELK est le laboratoire idéal si vous souhaitez développer des capacités de détection efficaces. Il a été conçu en pensant aux défenseurs. Son objectif...

HELK

HELK Hunting ELK, 또는 간단히 HELK는 SQL 선언적 언어, 그래프, 구조적 스트리밍, 그리고 Jupyter 노트북과 Apache Spark를 통한 머신러닝까지 고급 분석 기능을 갖춘 최초의 오픈 소스 헌트 플랫폼 중 하나입니다. 이 프로젝트는 주로 연구 목적으로 개발되었지만, 유연한 설계와 핵심 구성 요소 덕분에 적절한 구성과 확장 가능한 인프라를 갖춘 대규모 환경에도 배포할 수 있습니다. 목표 커뮤니티에 오픈 소스 헌팅 플랫폼을 제공하고 위협 헌팅의 기본을 공유합니다. 헌트 플랫폼 배포 시간을 단축합니다. ...

dsiem

Dsiem Dsiem est un moteur de corrélation d'événements de sécurité pour ELK stack, permettant d'utiliser la plateforme comme un système SIEM dédié et complet. Dsiem fournit une corrélation de style OSSIM pour les journaux/événements normalisés, effectue des recherches/interrogations vers des sourc...

atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

DShield-SIEM

DShield Sensor Log Collection with Elasticsearch Введение Это форк и значительное обновление первоначальной публикации на сайте ISC Storm Center, автором которой является Скотт Дженсен Scott Jensen, в виде статьи BACS и скриптов, опубликованных на Github. https://github.com/fkadriver/Dshield-ELK...

tsharkVM

💡 Mise à jour : tshark-opensearch Une application plus récente tshark-opensearch est désormais disponible. Vous pouvez la trouver dans le dépôt https://github.com/h21-lab/apps-collection-info. 👉 Obtenir l'accès Appliance VM tshark ELK Ce projet construit une machine virtuelle qui peut être utilis...

gaia

Gaia : Évaluateur mondial de l'intégrité des API Dépendances Installez opam pour construire l'API de tests. Installez git, python3, pip et .NET pour construire RESTler et Schemathesis. Installez cargo pour construire Gaia. Installez docker v26.0.1 et docker compose v2.26.1 pour construire Gaia av...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk

DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to...

LinuxCatScale - Incident Response Collection And Processing Scripts With Automated Reporting Scripts

Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process. Usage This script...

tsharkVM - Tshark + ELK Analytics Virtual Machine

This project builds virtual machine which can be used for analytics of tshark -T ek ndjson output. The virtual appliance is built using vagrant, which builds Debian 10 with pre-installed and pre-configured ELK stack. After the VM is up, the process is simple: decoded pcaps tshark -T ek output /...

Bughound - Static Code Analysis Tool Based On Elasticsearch

Bughound is an open-source static code analysis tool that analyzes your code and sends the results to Elasticsearch and Kibana to get useful insights about the potential vulnerabilities in your code. Bughound has its own Elasticsearch and Kibana Docker image that is preconfigured with dashboards ...

HELK - The Hunting ELK

The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was developed...

HELK: one with the advanced analysis capabilities of vulnerability discovery platform-vulnerability warning-the black bar safety net

Today to introduce to you is a guy named HELK a tool, it is a superior analytical capability of Hunting ELK（Elasticsearch, Logstash, Kibana is. ! Target 1. To the security community to provide a free vulnerability Hunting platform, and shared some basic security threats and vulnerability discover...

Multi-Honeypot Platform: T-Pot

Multi-Honeypot Platform T-Pot is based on Ubuntu Server 16.10 LTS. The honeypot daemons as well as other support components being used have been paravirtualized using docker . This allowed developers to run multiple honeypot daemons on the same network interface without problems and make the enti...

HoneyDrive 3 - The Premier Honeypot Linux Distro

HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance OVA with Xubuntu Desktop 12.04.4 LTS edition installed. It contains over 10 pre-installed and pre-configured honeypot software packages such as Kippo SSH honeypot, Dionaea and Amun malware honeypots, Honeyd low-interaction...

Honeypot Linux Distro: HoneyDrive

HoneyDrive is the premier honeypot Linux distro. It is a virtual appliance OVA with Xubuntu Desktop 12.04.4 LTS edition installed. It contains over 10 pre-installed and pre-configured honeypot software packages such as Kippo SSH honeypot, Dionaea and Amun malware honeypots, Honeyd low-interaction...