awesome-wazuh

awesome-wazuh Curated list of Wazuh resources, tools, and integrations Wazuh is a free, open-source security monitoring platform for threat prevention, detection, and response. Contents Official Documentation Getting Started Setup Guides Deployment Docker Kubernetes Terraform / OpenTofu Ansible...

gp_netSecDSS

netSecDSS Decision Support System for Risk Assessing Network and System Security in SMEs A Docker-based network security monitoring platform built for small and medium enterprises that can't afford commercial SIEM tools. It simulates a realistic multi-subnet SME network, runs staged attack...

detection-rules

Detection Rules Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine. This repository was first announced on Elastic's blog post, Elastic Security...

joy

| |/ | | | | | | | || |/ |/ , | |/ | / A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring. TLS Fingerprinting Addendum: For our most recent network fingerprinting tools and data, please see Mercury. Overview Joy is ...

securitybot

Securitybot Distributed alerting for the masses! Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber's blog post. Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster...

zeek

The Zeek Network Security Monitor A powerful framework for network traffic analysis and security monitoring. Key Features — Documentation — Getting Started — Development — License Key Features In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at...

Audix

| / /| | / / / / / |// / // // // / / // |,/ ,/ // //|| is a PowerShell tool to quickly configure the Windows Event Audit Policies for monitoring & incident response. Please note: This tool will only change the local security policy. If applied to a host with a GPO setting, it is best to use the...

kunai

Leitmotiv Kunai is a powerful tool designed to bring actionable insights for tasks such as security monitoring and threat hunting on Linux systems. Think of it as the Linux counterpart to Sysmon on Windows, tailored for comprehensive and precise event monitoring. Why Kunai Stands Out...

securityonion

Security Onion Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It includes a comprehensive suite of tools designed to work together to provide visibility into your network and host activity. ✨ Features Security Onion...

passivedns

| | @ | \ | \ | || | TM | |.------. .-----. .-----. -. .-.------. | |\ || | || | | | | || --'| --'| |\ Y /| --| | |/ || || | | || || ||||||| / | /|/ | |||| A tool to collect DNS records passively to aid Incident handling, Network Security Monitoring NSM and general digital forensics. PassiveDNS...

ved-ebpf

VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF VED Vault Exploit Defense-eBPF leverages eBPF extended Berkeley Packet Filter to implement runtime kernel security monitoring and exploit detection for Linux systems. Introduction eBPF is an in-kernel virtual machine that allows code...

cloud-custodian

Cloud Custodian c7n Cloud Custodian, also known as c7n, is a rules engine for managing public cloud accounts and resources. It allows users to define policies to enable a well managed cloud infrastructure, that's both secure and cost optimized. It consolidates many of the adhoc scripts...

attack_monitor

Attack Monitor Attack Monitor is Python application written to enhance security monitoring capabilites of Windows 7/2008 and all later versions workstations/servers and to automate dynamic analysis of malware. Current modes mutually exclusive: Endpoint detection ED Malware analysis on dedicated...

ai-bot-ip-ranges

AI Bot IP Ranges A collection of official IP ranges for AI bot crawlers from major providers. Overview This repository tracks and aggregates IP address ranges published by AI providers for their web crawlers. These ranges are useful for: Verifying legitimate bot traffic Configuring firewall rules...

SharePointSecurityMonitor

🛡️ SharePoint Security Monitor v5.0 🚀 A comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2023-29357 and CVE-2023-33157 protection, intelligent DLL management, advanced threat detection, and automated alerting capabilities. 📋 Table of Contents 🌟 Project Overview ✨ Key...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

laurel

Linux Audit – Registro utilizable, robusto y fácil LAUREL es un complemento de postprocesamiento de eventos para auditd8 que genera registros de auditoría JSON enriquecidos y útiles, adecuados para configuraciones modernas de monitoreo de seguridad. La documentación correspondiente a la última...

securitybot

Securitybot ¡Alertas distribuidas para las masas! Securitybot es una implementación de código abierto de un chatbot de alertas distribuidas, como se describe en la publicación del blog de Ryan Huber. Las alertas distribuidas mejoran la eficiencia de monitoreo de tu equipo de seguridad y pueden...

security_monkey

NOTA: Security Monkey è in modalità manutenzione e sarà dismesso nel 2020. Per gli utenti AWS, si prega di utilizzare AWS Config. Per gli utenti GCP, si prega di utilizzare Cloud Asset Inventory. Security Monkey Security Monkey monitora i tuoi account AWS e GCP per rilevare modifiche alle policy ...

CVE-2026-105242

A flaw was found in log4net. A remote attacker can exploit this issue by sending a crafted request containing content such as markup that triggers ASP.NET request validation. When log4net attempts to parse the request parameters, an unhandled exception occurs, causing the logging system to discar...