A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [PRE-ALPHA]

✭ 127

python react nodejs machine-learning tensorflow security elasticsearch flask spark analytics cybersecurity anomaly-detection sklearn datascience elk information-security siem

Threathunting Spl

Splunk code (SPL) useful for serious threat hunters.

✭ 117

threat-hunting rules siem

Redelk

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

✭ 1,692

python shell ruby Dockerfile Jupyter Notebook security monitoring elasticsearch kibana logstash elastic siem red-teaming

Siac

SIAC is an enterprise SIEM built on open-source technology.

✭ 100

security aws incident-response elk compliance intrusion-detection siem osquery pci-dss

Awesome Cybersecurity

Curated list of awesome cybersecurity companies and solutions.

✭ 77

security malware cybersecurity threatintel siem

Talr

Threat Alert Logic Repository

✭ 76

shell siem

Project Sauron

Tools to create a Native Windows Audit Collection Platform. Active Directory example provided

✭ 58

powershell event subscription siem

Siem From Scratch

SIEM-From-Scratch is a drop-in ELK based SIEM component for your Vagrant infosec lab

✭ 31

shell infosec vagrant elk elastic siem

Graylog2 Server

Free and open source log management

✭ 5,952

java typescript javascript CSS ANTLR shell security kafka logging amqp syslog siem graylog log-analysis gelf log-viewer logging-server secure-logging log-collector log-management hacktoberfest

Sentinel Attack

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

✭ 676

logging security-tools hcl azure detection cybersecurity threat-hunting mitre-attack siem sysmon

Nzyme

Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog (Open Source log management) setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode.

✭ 507

java security infosec wifi siem graylog

Event Forwarding Guidance

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

✭ 605

powershell windows siem

Security Apis

A collective list of public JSON APIs for use in security. Contributions welcome

✭ 508

security awesome-list json-api siem

Sigma

Generic Signature Format for SIEM Systems

✭ 4,418

python Makefile security monitoring elasticsearch logging ids siem sysmon splunk signatures

Meerkat

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

✭ 284

powershell security analysis monitor log recon forensics threat-hunting scan response siem baseline threat

Attackdatamap

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

✭ 264

powershell dfir threat-hunting mitre-attack siem

blue-teaming-with-kql

Repository with Sample KQL Query examples for Threat Hunting

✭ 102

security azure threat-hunting siem loganalytics blueteaming azure-data-explorer kql azure-sentinel

ansible-splunk-playbook

Install a full Splunk Enterprise Cluster or Universal forwarder using an ansible playbook

✭ 34

shell ansible splunk logging siem splunk-enterprise

awesomekql

Azure Sentinel intrusion detection rules, recent exploits and lolbas :)

✭ 16

azure siem detection-rules lolbas

Kong-API-Manager

Kong API Manager with Prometheus And Graylog

✭ 78

python shell javascript Dockerfile api docker security docker-compose splunk grafana prometheus kong siem security-tools konga

Logmira

Logmira by Blumira has been created by Amanda Berlin as a helpful download of Microsoft Windows Domain Group Policy Object settings.

✭ 46

security-audit logging siem group-policy group-policy-object gpo-backup verbosity-files-gpologgingimport

siemstress

Very basic CLI SIEM (Security Information and Event Management system).

skalogs-bundle

Open Source data and event driven real time Monitoring and Analytics Platform

✭ 16

shell docker kubernetes ansible elasticsearch kibana logstash kafka grafana prometheus rancher zookeeper cattle itoa siem elk-stack logmanagement

detection-rules

Threat Detection & Anomaly Detection rules for popular open-source components

✭ 34

elasticsearch splunk threat-hunting siem sigma anomaly-detection threat-detection

GDPatrol

A Lambda-powered Security Orchestration framework for AWS GuardDuty

✭ 50

python aws cloud aws-lambda incident-response cybersecurity siem threatintel aws-security blueteam cloudsecurity soar aws-guardduty

cli-eaa

CLI for Enterprise Application Access (EAA)

✭ 19

python shell logs akamai siem akamai-cli cli-eaa enterprise-cli

siembol

An open-source, real-time Security Information & Event Management tool based on big data technologies, providing a scalable, advanced security analytics framework.

✭ 153

java typescript HTML SCSS powershell shell security cloud big-data siem metron gr-oss

OpenSIEM-Logstash-Parsing

SIEM Logstash parsing for more than hundred technologies

✭ 140

python logstash parsing logs siem

auditbeat-in-action

Demo for Elastic's Auditbeat and SIEM

✭ 24

HCL HTML elasticsearch filebeat siem auditd auditbeat

SysmonConfigPusher

Pushes Sysmon Configs

✭ 59

C#windows sysmon threat-hunting siem

Azure-Sentinel-4-SecOps

Microsoft Sentinel SOC Operations

✭ 140

powershell HTML CSS M4 microsoft security azure incident-response secops threat-hunting siem hunting soc ir cloudsecurity threat-intelligence azure-sentinel microsoft-sentinel

LogRhythm.Tools

LogRhythm PowerShell Toolkit

✭ 37

powershell siem logrhythm smartresponse

SWELF

Simple Windows Event Log Forwarder (SWELF). Its easy to use/simply works Log Forwarder and EVTX Parser. Almost in full release here at https://github.com/ceramicskate0/SWELF/releases/latest.

✭ 23

C#windows analytics analysis dotnet detection logging logs cybersecurity sysmon siem hunting forwarder defense eventlog log-forwarder evtx logging-framework logging-agent windowsevents

LogESP

Open Source SIEM (Security Information and Event Management system).

ansible-role-auditbeat

Ansible role to install auditbeat for security monitoring. (Ruleset included)

✭ 15

Jinja python powershell security ansible elasticsearch monitoring ansible-role siem auditd elk-stack auditbeat auditd-attack

Blue-Baron

Automate creating resilient, disposable, secure and agile monitoring infrastructure for Blue Teams.

✭ 23

python HCL Mustache Makefile Dockerfile kubernetes security monitoring terraform infrastructure-as-code cloud-native siem elastic security-tools blue-team

qradar

Unofficial third-party scripts, playbooks, and content for IBM QRadar & QRadar Community Edition.

✭ 53

shell siem blueteam qradar

1-46 of 46 siem projects