Popular repositories Loading

1. evtxtoelk evtxtoelk Public

   Load Windows Event Log (.evtx) files into Elasticsearch, or export them as JSON lines. Born on an offline threat hunt; rebuilt for Elasticsearch 9.

   Python 122 31

2. ParseZeekLogs ParseZeekLogs Public

   Read Zeek (Bro) logs into typed Python records; convert to JSON or CSV, map to Elastic Common Schema, load into Elasticsearch.

   Python 44 10

3. Blog-Code Blog-Code Public

   Jupyter notebooks from the Threat Hunting with Python series: hunting Nmap in Bro HTTP logs and dissecting MS SQL TDS traffic, with the original posts preserved

   Jupyter Notebook 22 10

4. pcaptojson pcaptojson Public

   Python 4 1

5. icsdfir icsdfir Public

   Tips, tricks, tools, and tactics for incident response and digital forensics in industrial environments.

   4

6. DetectionBench DetectionBench Public

   Deterministic static analysis for Sigma detection rules: Pyramid of Pain tier, scope, lint, ATT&CK.

   Python 1