siem · GitHub Topics

Wazuh - 开源安全平台

安全 compliance Logging vulnerability-detection Cybersecurity file-integrity-monitoring malware-detection cloud-security container-security security-automation siem xdr configuration-assessement incident-response pci-dss security-hardening wazuh

C++ 11.93 k

30 分钟前

SigmaHQ / sigma

Main Sigma Rule Repository

翻译 - SIEM系统的通用签名格式

安全监控 siem Logging signatures elasticsearch splunk ids sysmon

Python 8.79 k

8 天前

Graylog2 / graylog2-server

Free and open log management

翻译 - 免费和开源日志管理

Logging log-collector log-viewer logging-server siem secure-logging 安全 gelf syslog graylog kafka amqp log-management Hacktoberfest

Java 7.58 k

3 小时前

outflanknl / RedELK

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

翻译 - 红队的SIEM-红队的工具，用于跟踪和警告蓝队的活动，以及在长期运营中具有更高的可用性。

安全 siem 监控 elastic elasticsearch logstash kibana red-teaming

Python 2.43 k

1 个月前

mozilla / MozDef

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform

siem Python elk elk-stack elasticsearch 安全 unmaintained

Python 2.17 k

3 年前

sherifabdlnaby / elastdocker

🐳 Elastic Stack (ELK) v8+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.

翻译 - Docker上的弹性堆栈（ELK），具有预配置的安全性，工具，自我监控和Prometheus指标导出器。

elk elk-stack elasticstack Docker Docker Compose docker-compos-template elasticsearch siem observability kibana logstash

Dockerfile 1.86 k

2 个月前

mikeroyal / Digital-Forensics-Guide

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Python 1.76 k

1 年前

matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

Amazon Web Services cloud 安全 big-data Serverless apache-iceberg log-analytics log-management threat-hunting Rust alerting cloud-native aws-security cloud-security Cybersecurity secops dfir detection-engineering siem

Rust 1.52 k

2 个月前

cyb3rxp / awesome-soc

A collection of sources of documentation, as well as field best practices, to build/run a SOC

cert detection soc siem soa soar tip architecture incident-response management mitre-attack purpleteam risk-management ttp

1.34 k

23 天前

pfelk / pfelk

pfSense/OPNsense + Elastic Stack

pfsense elasticsearch elastic siem firewall logs Docker

Shell 1.11 k

2 个月前

netevert / sentinel-attack

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

siem threat-hunting mitre-attack sysmon Azure blue-team Cybersecurity Logging 安全 detection kql

HCL 1.07 k

3 个月前

mikeroyal / Open-Source-Security-Guide

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

vulnerabilities vulnerability-detection privacy-protection pentesters network-analysis intrusion-detection Cybersecurity incident-management mitre-attack detection-engineering kali-linux offensive-security siem compliance cyber-security scanning-tool incident-response forensics-tools surveillance

Go 949

1 年前

jaegeral / security-apis

#Awesome#A collective list of public APIs for use in security. Contributions welcome

Awesome Lists 安全 siem JSON:API JSON

908

7 个月前

mthcht / awesome-lists

#Awesome#Awesome Security lists for SOC/CERT/CTI

blueteam hacktools redteam 安全 soc Awesome Lists cti IoC (Disambiguation)blueteam-tools detection detection-engineering dfir incident-response iocs siem threat-hunting threat-intelligence ransomware rmm

YARA 872

10 小时前

nsacyber / Event-Forwarding-Guidance

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

Windows event-log siem

PowerShell 860

4 年前

threathunters-io / laurel

Transform Linux Audit logs for SIEM usage

Linux Rust contributions-welcome 安全 security-monitoring siem

Rust 751

9 天前

tenzir / tenzir

Tenzir is the data pipeline engine for security teams.

incident-response threathunting siem soc 安全 DataOps investigation pcap netflow suricata zeek pipelines sigma Hacktoberfest

C++ 668

1 天前

runreveal / pql

Pipelined Query Language

clickhouse detection-engineering Go query-language siem SQL

Go 647

2 个月前

TonyPhipps / SIEM

SIEM Tactics, Techiques, and Procedures

threat Red blue purple team incident response baseline 监控 analysis scan log forensics Reconnaissance threat-hunting 安全 soc siem

PowerShell 615

16 天前

iknowjason / PurpleCloud

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

Azure pentest purpleteam siem dfir dfir-automation

Python 554

3 个月前