siem

Free and open source log management

Generic Signature Format for SIEM Systems

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

🐳 Elastic Stack (ELK) v8+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.

Nzyme is a free and open next-generation WiFi defense system. Go to www.nzyme.org for more information.

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

pfSense/OPNsense + Elastic Stack

Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

A collective list of public APIs for use in security. Contributions welcome

Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.

🔮 Visibility Across Space and Time – The network telemetry engine for data-driven security investigations.

Security event correlation engine for ELK stack

A collection of PowerShell modules designed for artifact gathering and reconnaisance of Windows-based endpoints.

Set of EVTX samples (>270) mapped to MITRE Att@k tactic and techniques to measure your SIEM coverage or developed new use cases.

A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework

A little tool to play with Azure Identity - Azure Active Directory lab creation tool

SIEM Tactics, Techiques, and Procedures

Encyclopedia for Executables

A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [PRE-ALPHA]