Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

security security-audit log-analysis incident-response cybersecurity pci-dss infosec compliance xdr siem security-hardening vulnerability-detection security-automation security-tools wazuh cloud-security malware-detection container-security file-integrity-monitoring configuration-assessement

• Updated Nov 12, 2026
• C++

Main Sigma Rule Repository

security elasticsearch monitoring splunk logging ids signatures sysmon siem

• Updated Nov 10, 2026
• Python

Free and open log management

security kafka log-analysis gelf graylog log-viewer amqp logging syslog logging-server secure-logging log-collector siem log-management hacktoberfest

• Updated Nov 12, 2026
• Java

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

mcp incident-response self-hosted cybersecurity siem soc threat-intelligence soar blue-team mitre-attack ai-security threat-detection purple-team security-operations detection-engineering alert-triage llm-agents langgraph agentic-ai model-context-protocol

• Updated Nov 12, 2026
• Python

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

security osint alerting forensics dfir intrusion-detection siem digital-forensics offensive-security cyber-security network-security port-scanning forensic-analysis threat-intelligence mitre-attack forensics-investigations detection-engineering digitalforensics forensics-tools digitalforensicreadiness

• Updated Jan 4, 2024
• Python

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

security elasticsearch kibana logstash monitoring siem elastic red-teaming

• Updated Nov 10, 2026
• Python

Fast and easy to use database for logs, which can efficiently handle terabytes of logs

kubernetes elasticsearch grafana logging logs siem loki observability opentelemetry

• Updated Nov 12, 2026
• Go

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform

python security elasticsearch elk abandoned unmaintained siem elk-stack

• Updated Nov 2, 2021
• Python

🐳 Elastic Stack (ELK) v9+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.

docker elasticsearch kibana elasticstack logstash docker-compose elk siem observability elk-stack

• Updated Nov 9, 2026
• Dockerfile

Awesome Security lists for SOC/CERT/CTI

security ioc detection incident-response dfir ransomware awesome-list threat-hunting siem iocs cti soc ir blueteam threat-intelligence rmm redteam hacktools detection-engineering blueteam-tools

• Updated Nov 12, 2026
• YARA

A curated knowledge base to build, run and mature a SOC (including CSIRT).

architecture incident-response dfir cybersecurity cert csirt threat-hunting siem tip soc risk-management ttp soar sirp mitre-attack purpleteam threat-detection security-monitoring detection-engineering

• Updated Nov 2, 2026

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

rust aws security cloud big-data serverless alerting dfir secops cybersecurity cloud-native threat-hunting siem log-management aws-security security-tools cloud-security log-analytics apache-iceberg detection-engineering

• Updated Jan 8, 2025
• Rust

Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)

ai cybersecurity siem blueteam soar dify llm langchain langgraph agentic-soc

• Updated Sep 29, 2026
• Python

pfSense/OPNsense + Elastic Stack

docker elasticsearch firewall logs opnsense siem elastic pfsense

• Updated Oct 2, 2026
• Shell

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

surveillance incident-response intrusion-detection infosec compliance siem vulnerabilities network-analysis information-security kali-linux vulnerability-detection offensive-security cyber-security incident-management pentesters privacy-protection mitre-attack scanning-tool detection-engineering forensics-tools

• Updated Jun 27, 2025
• Go

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

azure detection logging cybersecurity sysmon threat-hunting siem security-tools blue-team mitre-attack workbooks sysmon-config terraform-azure kql azure-sentinel

• Updated Nov 28, 2024

A collective list of public APIs for use in security. Contributions welcome

security json json-api awesome-list siem

• Updated Nov 3, 2026

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

windows event-log siem

• Updated Nov 17, 2020
• PowerShell

Transform Linux Audit logs for SIEM usage

linux rust security siem auditd contributions-welcome audispd security-monitoring

• Updated Nov 3, 2026
• Rust

Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.

graylog logging forensics dfir sysmon threat-hunting siem threat-sharing threatintel netsec sysinternals graylog-plugin forensic-analysis threat-analysis threat-intelligence humio mitre-attack sigma-rules forensicartifacts digitalforensics

• Updated Nov 5, 2023
• PowerShell