Tools

Generates lightweight, embedded honeypot triggers called canary tokens for detecting unauthorized access.

Splunk Security Content

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Malicious traffic detection system

Main Sigma Rule Repository

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

IntelOwl: manage your Threat Intelligence at scale

tirreno is an open-source security framework. Event tracking, threat detection, and risk scoring for any application.

Web-based dashboard for Fail2Ban log filtering and blocklist control

A network intrusion detection tool

The pattern matching swiss knife

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.

Web-based Traffic and Security Network Traffic Monitoring

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

A framework for secure and scalable network traffic analysis - https://netcap.io

Bloodhound Reporting for Blue and Purple Teams