Opensource Security Operation Centers and Incident Response system.
-
HELK
A hunting platform to detect and analyze threats using open-source tools like Elasticsearch, Kibana, and Apache Kafka, enabling real-time security event processing and analysis. -
Graylog
A log management tool for collecting, indexing, and analyzing machine data to identify anomalies, investigate issues, and visualize performance trends. -
Velociraptor
A powerful endpoint monitoring and digital forensics tool that provides real-time querying and response capabilities for investigating cybersecurity incidents. -
Velociraptor Exchange
A repository of community-shared Velociraptor artifacts for performing endpoint investigations, such as scripts, queries, and configuration templates. -
Wazuh
An open-source security platform offering threat detection, compliance management, and incident response across diverse IT infrastructures. -
ElastiFlow
A network flow monitoring and analytics solution built on the Elastic Stack, enabling visibility into network performance and security. -
Arkime
A large-scale, open-source network traffic capture and analysis tool designed for security monitoring and network troubleshooting. -
osquery
A tool to query and investigate the state of an operating system using SQL-like syntax, offering insights into system behavior and security posture. -
TheHive
An open-source Security Incident Response Platform (SIRP) for managing and investigating security incidents collaboratively. -
Cortex
A powerful observables analysis engine that automates the enrichment of threat intelligence data to support incident response activities. -
Shuffle
An open-source security automation platform for building workflows to streamline threat response, investigation, and IT operations. -
IRIS Web
A platform for collaborative incident response and investigation that centralizes case management, evidence handling, and analysis. -
MISP
A threat intelligence platform for sharing, storing, and analyzing security incidents and indicators of compromise (IOCs). -
Jupyter
An interactive computational environment for creating and sharing documents with live code, visualizations, and narrative text, used extensively in data science and research. -
Suricata
A high-performance network threat detection engine capable of intrusion detection (IDS), intrusion prevention (IPS), and network monitoring. -
Zeek
A network security monitor that analyzes traffic for unusual patterns, providing insights into potential threats through detailed protocol analysis. -
VECTR
A tool for managing adversary emulation and attack simulation exercises, enabling the evaluation of defensive capabilities and security posture. -
SOC OpenSource
A curated list of open-source tools for building and enhancing Security Operations Centers (SOC), focusing on detection, analysis, and response.