Graylog2 / graylog2-server

Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog (Open Source log management) setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode.

security graylog wifi infosec siem

Updated Oct 12, 2020
Java

jaegeral / security-apis

Star

A collective list of public JSON APIs for use in security. Contributions welcome

security json-api awesome-list siem

Updated Oct 6, 2020

TonyPhipps / Meerkat

Star

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

Updated Feb 27, 2020
PowerShell

olafhartong / ATTACKdatamap

Star

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

dfir threat-hunting siem mitre-attack threat-detection

Updated Oct 7, 2020
PowerShell

beave / sagan

Star

Sagan uses a 'Snort like' engine and rules to analyze logs (syslog/event log/snmptrap/netflow/etc)

security log syslog ids siem nsm ips log-monitoring

Updated Oct 9, 2020
C

defenxor / dsiem

Star

Security event correlation engine for ELK stack

security elasticsearch logstash elk lookup siem ossim ossim-style-correlation

Updated Sep 14, 2020
Go

n0dec / MalwLess

Star

Test Blue Team detections without running any attack.

powershell dfir sysmon siem hacktoberfest blueteam redteam mitre-attack

Updated Oct 8, 2020
C#

tenzir / vast

Star

🔮 Visibility Across Space and Time

network-forensics incident-response caf actor-model bitmap-index dfir siem soc threathunting

Updated Oct 12, 2020
C++

NVISO-BE / ee-outliers

Star

Open

Implement Local Outlier Factor as trigger_method

daanraman commented Apr 3, 2019

https://en.wikipedia.org/wiki/Local_outlier_factor

Create entropy metric which takes into account the length of the string

1

Open

allow support for min_value to match terms model

P4T12ICK / ypsilon

Star

Automated Use Case Testing

security ansible splunk malware elk siem cuckoo use-case

Updated May 1, 2018
TeX

TonyPhipps / SIEM

Star

SIEM Tactics, Techiques, and Procedures

Updated Oct 8, 2020

inodee / threathunting-spl

Star

Splunk code (SPL) useful for serious threat hunters.

rules splunk threat-hunting siem use-case

Updated Jul 1, 2020

citybasebrooks / SIAC

Star

SIAC is an enterprise SIEM built on open-source technology.

aws security incident-response elk intrusion-detection pci-dss compliance siem osquery fim secdevops wazuh

Updated Oct 31, 2018

dogoncouch / LogESP

Star

Open Source SIEM (Security Information and Event Management system).

security security-audit log-analysis log syslog web-application log-collector forensics secops siem log-management risk-assessment log-parser vulnerability-management risk-management security-tools log-monitoring security-analysis asset-management security-awareness

Updated Jun 5, 2020
Python

SecurityRiskAdvisors / TALR

Star

Threat Alert Logic Repository

siem stix taxii sigma

Updated Feb 7, 2019
Shell

GACWR / OpenUBA

Star

A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [PRE-ALPHA]