139 matches found
dsiem
Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...
HELK
HELK The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was...
atomic-red-team
Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...
evtx
EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...
LinuxCatScale
Linux-CatScale IR Collection Script Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the...
tsharkVM
💡 Update: tshark-opensearch More recent application tshark-opensearch is now available. You can find it in the https://github.com/h21-lab/apps-collection-info repository. 👉 Get Access tshark ELK VM appliance This project builds virtual machine which can be used for analytics of tshark -T ek ndjso...
Adama
Adama Searches For Threat Hunting and Security Analytics A collection of known log and / or event data searches for threat hunting and detection. They enumerate sets of searches used across many different data pipelines. Implementation details are for ELK. Adama is part of the SpaceCake project...
whids
IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...
DetectionLabELK
DetectionLabELK DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to all...
DShield-SIEM
DShield Sensor Log Collection with Elasticsearch Introduction This is fork and a significant update from the initial publication on the ISC Storm Center website by Scott Jensen as a BACS paper and the scripts published in Github. https://github.com/fkadriver/Dshield-ELK...
gaia
Gaia: Global API Integrity Assessor Dependencies Install opam to build the tests API. Install git, python3, pip and .NET to build RESTler and Schemathesis. Install cargo to build Gaia. Install docker v26.0.1 and docker compose v2.26.1 to build Gaia with the ELK Stack optionnal if not. Install nod...
dsiem
Dsiem Dsiem es un motor de correlación de eventos de seguridad para ELK stack, que permite que la plataforma se utilice como un sistema SIEM dedicado y completo. Dsiem proporciona correlación al estilo OSSIM para registros/eventos normalizados, realiza consultas a fuentes de inteligencia de...
daktari (>=0.0.92, <=0.0.93), graal (>=0.4.5rc2, <=0.4.5) +10 more potentially affected by CVE-2026-59890 via setuptools (67.7.1)
setuptools PYPI version 67.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - daktari =0.0.92, =0.4.5rc2, =0.104.3rc2, =0.9.0rc1, =0.21.4rc2, =0.3.8rc2, =0.2.8rc2, =0.2.8rc2, =0.2.8rc2, =0.7.0rc1, =0.9.0rc2, =0.9.0 -...
graal (0.4.5rc1), grimoire-elk (0.104.3rc1) +6 more potentially affected by CVE-2024-6345 via setuptools (67.7.0)
setuptools PYPI version 67.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - graal 0.4.5rc1 - grimoire-elk 0.104.3rc1 - perceval 0.21.4rc1 - perceval-mozilla 0.3.8rc1 - perceval-opnfv 0.2.8rc1 - perceval-puppet...
flexrunner (1.0.9), graal (>=0.4.3rc5, <=0.4.3) +13 more potentially affected by CVE-2024-6345 via setuptools (67.0.0)
setuptools PYPI version 67.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - flexrunner 1.0.9 - graal =0.4.3rc5, =0.104.0rc8, =1.0.2, =0.1.0, =0.21.2rc5, =0.3.6rc5, =0.2.6rc5, =0.2.6rc5, =0.2.6rc5, =1.1.0, =0.6.0rc4,...
datasaku (0.0.8), dovesnap (>=1.1.11, <=1.1.12) +13 more potentially affected by CVE-2026-0994 via protobuf (4.23.0)
protobuf PYPI version 4.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - datasaku 0.0.8 - dovesnap =1.1.11, =0.105.0rc2, =0.10.0rc1, =2.2.12, =15.32.0, =3.25.0, =1.7.0, =3.0.0, =0.8.0rc1, =0.10.0rc1, =0.10.0 -...
EUVD-2025-120007
Malicious code in western-amaranth-elk npm...
Malicious code in honest-turquoise-elk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b24c315bdaaaa70ffde94ffa47dd1cace75a29f6a70c897672941508a87bd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...