Tools

Splunk Security Content

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Malicious traffic detection system

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

IntelOwl: manage your Threat Intelligence at scale

Main Sigma Rule Repository

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.