RedELK

RedELK The Red Team's SIEM - a tool for Red Teams for tracking and alarming about Blue Team activities as well as enhanced usability in long term operations. 1. Enhanced usability and overview for the red team operators by creating a central location where all relevant operational logs from...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment 使用主机信息丰富 Zeek 日志 要使用 id 字段丰富所有日志，请使用标签 ".-all"。 要使用 id 字段丰富所有日志以及已知实体，请使用标签 ".-known-all"。 要仅丰富 conn.log，请使用标签 ".-conn"。 要仅丰富 conn.log 以及已知实体，请使用标签 ".-known-conn"。 有关详细文档，请参阅 https://docs.corelight.com...

FalconHound - A Blue Team Multi-Tool. It Allows You To Utilize And Enhance The Power Of Blo odHound In A More Automated Fashion

FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool. One of the challenging aspects of BloodHound is that it is a snapshot in time...