siem
There are 651 repositories under siem topic.
wazuh/wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
SigmaHQ/sigma
Main Sigma Rule Repository
Graylog2/graylog2-server
Free and open log management
outflanknl/RedELK
Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
mikeroyal/Digital-Forensics-Guide
Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
mozilla/MozDef
DEPRECATED - MozDef: Mozilla Enterprise Defense Platform
sherifabdlnaby/elastdocker
🐳 Elastic Stack (ELK) v8+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.
matanolabs/matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
cyb3rxp/awesome-soc
A collection of sources of documentation, as well as field best practices, to build/run a SOC
pfelk/pfelk
pfSense/OPNsense + Elastic Stack
mthcht/awesome-lists
Awesome Security lists for SOC/CERT/CTI
netevert/sentinel-attack
Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK
mikeroyal/Open-Source-Security-Guide
Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.
jaegeral/security-apis
A collective list of public APIs for use in security. Contributions welcome
nsacyber/Event-Forwarding-Guidance
Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber
tirrenotechnologies/tirreno
tirreno — open-source security analytics. Understand, monitor, and protect your application from cyber threats, account takeovers, and abuse. Get started — free.
ion-storm/sysmon-config
Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.
threathunters-io/laurel
Transform Linux Audit logs for SIEM usage
tenzir/tenzir
Tenzir is the data pipeline engine for security teams.
runreveal/pql
Pipelined Query Language
TonyPhipps/SIEM
SIEM Tactics, Techiques, and Procedures
mthcht/ThreatHunting-Keywords
Awesome list of keywords and artifacts for Threat Hunting sessions
iknowjason/PurpleCloud
A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4
mdecrevoisier/EVTX-to-MITRE-Attack
Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
VictoriaMetrics/VictoriaLogs
Fast and easy to use database for logs, which can efficiently handle terabytes of logs
turbot/tailpipe
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
TonyPhipps/Meerkat
A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.
GACWR/OpenUBA
A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [PRE-ALPHA]
strontic/xcyclopedia
Encyclopedia for Executables
defenxor/dsiem
Security event correlation engine for ELK stack
panther-labs/panther-analysis
Built-in Panther detection rules and policies
utmstack/UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
olafhartong/ATTACKdatamap
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
inodee/threathunting-spl
Splunk code (SPL) for serious threat hunters and detection engineers.
n0dec/MalwLess
Test Blue Team detections without running any attack.
eshlomo1/Microsoft-Sentinel-SecOps
Microsoft Sentinel SOC Operations