127 matches found
LinuxCatScale
Linux-CatScale 应急响应数据采集脚本 Linux CatScale 是一个利用系统原生工具从 Linux 主机广泛采集数据的 Bash 脚本。所采集的数据旨在帮助数字取证与事件响应（DFIR）专业人员对事件进行分类和范围界定。同时提供了一个 ELK 栈实例来消费输出结果并协助分析过程。 使用方法 解析 它收集了什么 免责声明 已测试的操作系统 使用方法 此脚本旨在尽可能自动化。我们建议从外部设备/U 盘运行，以避免覆盖证据，以防将来需要完整镜像。 请在疑似受感染的主机上使用 sudo...
atomic-red-team
Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...
HELK
HELK El Hunting ELK o simplemente HELK es una de las primeras plataformas de caza de código abierto con capacidades avanzadas de análisis, como lenguaje declarativo SQL, gráficos, streaming estructurado e incluso aprendizaje automático a través de Jupyter notebooks y Apache Spark sobre una pila...
dsiem
Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...
dsiem
Dsiem Dsiem es un motor de correlación de eventos de seguridad para ELK stack, que permite que la plataforma se utilice como un sistema SIEM dedicado y completo. Dsiem proporciona correlación al estilo OSSIM para registros/eventos normalizados, realiza consultas a fuentes de inteligencia de...
tsharkVM
💡 更新：tshark-opensearch 最新应用 tshark-opensearch 现已可用。 您可以在 https://github.com/h21-lab/apps-collection-info 仓库中找到它。 👉 获取访问权限 tshark ELK 虚拟机设备 该项目构建了一台可用于分析 tshark -T ek ndjson 输出的虚拟机。 该虚拟设备使用 vagrant 构建，构建的 Debian 系统预装了 ELK 栈并已配置完成。 VM 启动后，流程很简单： 解码后的 pcap 文件（tshark -T ek 输出 / ndjson）通过 TCP/17570 发送...
DShield-SIEM
DShield Sensor Log Collection with Elasticsearch Introducción Este es un fork y una actualización significativa de la publicación inicial en el sitio web de ISC Storm Center por Scott Jensen como un documento BACS y los scripts publicados en Github. https://github.com/fkadriver/Dshield-ELK...
Adama
Adama 威胁狩猎与安全分析搜索集 一组用于威胁狩猎和检测的已知日志和/或事件数据搜索。它们枚举了跨多种不同数据管道使用的搜索集。实现细节针对 ELK。Adama 是 SpaceCake 项目的一部分，该项目包含一系列狩猎、搜索、告警、可视化以及数据管道，用于入侵检测、安全分析和威胁狩猎，并采用 F/OSS（免费开源）工具。...
evtx
EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...
DetectionLabELK
DetectionLabELK DetectionLabELK 是 Chris Long 的 DetectionLab 的一个分支，使用 ELK 堆栈替代了 Splunk。 描述 DetectionLabELK 是一个理想的实验室，适合想要构建有效检测能力的人使用。它专为防御者设计，主要目的是让蓝队能够快速搭建一个预装了安全工具并遵循系统日志配置最佳实践的 Windows 域。它可以很容易地修改以适应大多数需求，或扩展以包含额外的主机。 使用场景 DetectionLabELK 的一个常见使用场景是当您考虑采用 MITRE ATT&CK 框架并希望为其战术开发检测规则时。您可以使用...
whids
IMPORTANT: this README and other documentation is not updated to reflect the changes made to latest beta releases as a lot of changes happened. All this will be updated in time when a stable version will be released see Roadmap until next release. Feel free to run beta releases on your own and as...
gaia
Gaia: Evaluador Global de Integridad de API Dependencias Instalar opam para compilar la API de pruebas. Instalar git, python3, pip y .NET para compilar RESTler y Schemathesis. Instalar cargo para compilar Gaia. Instalar docker v26.0.1 y docker compose v2.26.1 para compilar Gaia con ELK Stack...
EUVD-2025-120007
Malicious code in western-amaranth-elk npm...
EUVD-2025-117320
Malicious code in honest-turquoise-elk npm...
Malicious code in honest-turquoise-elk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b24c315bdaaaa70ffde94ffa47dd1cace75a29f6a70c897672941508a87bd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in cultural_elk_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7553762169673e5bf1da7b335ad3e1f55a610d0287a9cee54d521d4f703031ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-103523
Malicious code in navalelkz3n npm...
Malicious code in naval_elk_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 121aea9744217027ab909357183138b1fa54722169086774e9a890b34c0d9a10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in pure_elk_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 971ced70ea830acef8a97f3b36073ba1c3c47358307028d6c98576919588ee5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...