Topic: siem Goto Github

👇 Here are 322 public repositories matching this topic...

3coresec / siegma
siem,SIEGMA - Transform Sigma rules into SIEM consumables
Organization: 3coresec
Home Page: https://blog.3coresec.com/search/label/DaC
sigma detection-engineering siem security data-driven

annsec / awesome-cybersecurity
siem,Curated list of awesome cybersecurity companies and solutions.
Organization: annsec
cybersecurity siem malware threatintel security

ashwin-patil / blue-teaming-with-kql
siem,Repository with Sample KQL Query examples for Threat Hunting
User: ashwin-patil
threat-hunting blueteaming azure-data-explorer azure-sentinel kql security siem loganalytics azure

beave / sagan
siem,** README ** This repo has MOVED to https://github.com/quadrantsec/sagan
User: beave
Home Page: http://sagan.quadrantsec.com
security ids ips siem log syslog nsm log-monitoring

bgenev / impulse-xdr
siem,Fully automated host & network intrusion detection platform. Detects malware from behavioural patterns rather than signatures and enables deeper visibility than legacy tools.
User: bgenev
Home Page: https://impulse-xdr.com/
cybersecurity devops security-tools visibility vpc vpc-endpoints vps osquery server-security suricata

cargill / opensiem-logstash-parsing
siem,SIEM Logstash parsing for more than hundred technologies
Organization: cargill
logstash siem parsing logs

citybaseinc / siac
siem,SIAC is an enterprise SIEM built on open-source technology.
Organization: citybaseinc
siem security elk osquery intrusion-detection secdevops pci-dss fim compliance wazuh

controlcompass / controlcompass.github.io
siem,Pointing cybersecurity teams to thousands of detection rules and offensive security tests aligned with common attacker techniques
User: controlcompass
Home Page: https://controlcompass.github.io
security intelligence cybersecurity threat-intelligence threat-hunting red-teaming red-team detection detection-engineering mitre-attack siem security-tools security-operations soc infosec information-security

cyb3rxp / awesome-soc
siem,A collection of sources of documentation, as well as field best practices, to build/run a SOC
User: cyb3rxp
cert csirt detection soc siem sirp soa soar tip architecture

defenxor / dsiem
siem,Security event correlation engine for ELK stack
Organization: defenxor
siem elk elasticsearch logstash ossim security

dogoncouch / logesp
siem,Open Source SIEM (Security Information and Event Management system).
User: dogoncouch
siem risk-management risk-assessment vulnerability-management security security-tools secops security-audit web-application asset-management

ep3p / sentinel_kql
siem,In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool).
User: ep3p
microsoft security azure kql watchlist kusto sentinel siem entra entra-id

eshlomo1 / microsoft-sentinel-secops
siem,Microsoft Sentinel SOC Operations
User: eshlomo1
azure-sentinel security secops siem soc azure hunting ir incident-response microsoft

g-research / siembol
siem,An open-source, real-time Security Information & Event Management tool based on big data technologies, providing a scalable, advanced security analytics framework.
Organization: g-research
Home Page: https://siembol.io/
siem security big-data cloud metron gr-oss

gacwr / openuba
siem,A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [PRE-ALPHA]
Organization: gacwr
Home Page: http://openuba.org
ueba datascience cybersecurity analytics threathunting tensorflow spark flask information-security siem

graylog2 / graylog2-server
siem,Free and open log management
Organization: graylog2
Home Page: https://www.graylog.org
log-analysis log-collector log-viewer logging logging-server siem secure-logging security gelf syslog

iknowjason / purplecloud
siem,A little tool to play with Azure Identity - Azure Active Directory lab creation tool
User: iknowjason
Home Page: https://www.purplecloud.network
azure pentest purpleteam siem dfir dfir-automation azure-lab

inodee / threathunting-spl
siem,Splunk code (SPL) for serious threat hunters and detection engineers.
User: inodee
splunk threat-hunting use-case siem rules spl

jaegeral / security-apis
siem,A collective list of public APIs for use in security. Contributions welcome
User: jaegeral
Home Page: https://alexanderjaeger.de
awesome-list security siem json-api json

laresllc / sysmonconfigpusher
siem,Pushes Sysmon Configs
Organization: laresllc
sysmon threat-hunting windows siem

matanolabs / matano
siem,Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Organization: matanolabs
Home Page: https://matano.dev
aws cloud security big-data serverless apache-iceberg log-analytics log-management threat-hunting rust alerting cloud-native aws-security cloud-security cybersecurity secops security-tools dfir detection-engineering siem

mdecrevoisier / evtx-to-mitre-attack
siem,Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
User: mdecrevoisier
mitre-attack siem evtx threat-hunting redteam

mikeroyal / digital-forensics-guide
siem,Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
User: mikeroyal
digitalforensics digitalforensicreadiness forensics security forensics-tools digital-forensics threat-intelligence intrusion-detection mitre-attack detection-engineering

mikeroyal / open-source-security-guide
siem,Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.
User: mikeroyal
vulnerabilities vulnerability-detection privacy-protection pentesters network-analysis intrusion-detection infosec incident-management mitre-attack detection-engineering

mozilla / mozdef
siem,DEPRECATED - MozDef: Mozilla Enterprise Defense Platform
Organization: mozilla
siem python elk elk-stack elasticsearch security abandoned unmaintained

mthcht / purpleteam
siem,Purpleteam scripts simulation & Detection - trigger events for SOC detections
User: mthcht
blueteam detection linux mitre-attack offensive-scripts purpleteam redteam security siem simulation

mthcht / threathunting-keywords
siem,Awesome list of keywords and artifacts for Threat Hunting sessions
User: mthcht
Home Page: https://mthcht.github.io/ThreatHunting-Keywords/
awesome-list blueteam detection-engineering endpoint-security iocs offensive-scripts offensive-security redteam siem soc

n0dec / malwless
siem,Test Blue Team detections without running any attack.
User: n0dec
blueteam dfir mitre-attack sysmon siem redteam powershell hacktoberfest

netevert / sentinel-attack
siem,Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
User: netevert
azure azure-sentinel blue-team cybersecurity detection kql logging mitre-attack security-tools siem sysmon sysmon-config terraform-azure threat-hunting workbooks

nsacyber / event-forwarding-guidance
siem,Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber
Organization: nsacyber
event-log siem windows

nvisosecurity / ee-outliers
siem,Open-source framework to detect outliers in Elasticsearch events
Organization: nvisosecurity
Home Page: https://blog.nviso.eu
outliers netsec threat-hunting statistics security-monitoring anomaly-detection outlier-detection siem cirt security-operations ee-outliers ml machine-learning statistical-analysis

olafhartong / attackdatamap
siem,A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
User: olafhartong
dfir mitre-attack siem threat-detection threat-hunting

outflanknl / redelk
siem,Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
Organization: outflanknl
elastic elasticsearch kibana logstash monitoring red-teaming security siem

p4t12ick / ypsilon
siem,Automated Use Case Testing
User: p4t12ick
siem malware ansible splunk elk cuckoo use-case security

pfelk / pfelk
siem,pfSense/OPNsense + Elastic Stack
Organization: pfelk
pfsense elasticsearch opnsense elastic siem firewall logs docker

runreveal / pql
siem,Pipelined Query Language
Organization: runreveal
Home Page: https://pql.dev
clickhouse detection-engineering go golang query-language siem sql

safernandez666 / kong-api-manager
siem,Kong API Manager with Prometheus And Graylog
User: safernandez666
grafana prometheus api docker docker-compose kong konga siem splunk security

securityriskadvisors / talr
siem,Threat Alert Logic Repository
Organization: securityriskadvisors
siem stix taxii sigma

sherifabdlnaby / elastdocker
siem,🐳 Elastic Stack (ELK) v8+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.
User: sherifabdlnaby
Home Page: https://towardsdatascience.com/running-securing-and-deploying-elastic-stack-on-docker-f1a8ebf1dc5b
elk elk-stack elasticstack docker docker-compose docker-compos-template elasticsearch siem observability kibana

sigmahq / sigma
siem,Main Sigma Rule Repository
Organization: sigmahq
security monitoring siem logging signatures elasticsearch splunk ids sysmon

someengineering / cloud-security-list
siem,A list of cloud security tools and vendors.
Organization: someengineering
attack-surface-management aws azure cnapp cspm dspm gcp security siem

strontic / xcyclopedia
siem,Encyclopedia for Executables
User: strontic
Home Page: https://strontic.github.io/xcyclopedia
executable siem soar command-line exe lolbins ssdeep

tenzir / tenzir
siem,Open source security data pipelines.
Organization: tenzir
Home Page: https://docs.tenzir.com
incident-response threathunting siem soc security dataops investigation pcap secdataops netflow

tonyphipps / meerkat
siem,A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
User: tonyphipps
threat hunt red blue purple team incident response baseline monitor

tonyphipps / siem
siem,SIEM Tactics, Techiques, and Procedures
User: tonyphipps
threat hunt red blue purple team incident response baseline monitor

uncoderio / roota
siem,Roota is a public-domain language of threat detection and response that combines native queries from a SIEM, EDR, XDR, or Data Lake with standardized metadata and threat intelligence to enable automated translation into other languages
User: uncoderio
Home Page: https://roota.io
datalake edr roota siem xdr rootalanguage

uncoderio / uncoder_io
siem,An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.
User: uncoderio
Home Page: https://uncoder.io
datalake edr roota siem sigma threathunting translation xdr uncoder uncoderio

utmstack / utmstack
siem,Customizable SIEM and XDR powered by Real-Time correlation and Threat Intelligence
Organization: utmstack
Home Page: https://utmstack.com
compliance correlation edr incident-response log-management siem threat-intelligence threat-management utmstack xdr

wazuh / wazuh
siem,Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Organization: wazuh
Home Page: https://wazuh.com/
cloud-security compliance configuration-assessement container-security cybersecurity file-integrity-monitoring incident-response infosec log-analysis malware-detection pci-dss security security-audit security-automation security-hardening security-tools siem vulnerability-detection wazuh xdr

zercurity / zercurity
siem,Manage, monitor and improve your cyber security posture.
User: zercurity
Home Page: https://www.zercurity.com
osquery compliance cis-benchmark linux macos siem soar windows steampipe