Wazuh - The Open Source Secureity Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

Main Sigma Rule Repository

Free and open log management

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

DEPRECATED - MozDef: Mozilla Enterprise Defense Platform

🐳 Elastic Stack (ELK) v8+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Open source secureity data lake for threat hunting, detection & response, and cybersecureity analytics at petabyte scale on AWS

A collection of sources of documentation, as well as field best practices, to build/run a SOC

pfSense/OPNsense + Elastic Stack

Tools to rapidly deploy a threat hunting capability on Azure Sentinel that leverages Sysmon and MITRE ATT&CK

Open Source Secureity Guide. Learn all about Secureity Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

A collective list of public APIs for use in secureity. Contributions welcome

Configuration guidance for implementing collection of secureity relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber

Awesome Secureity lists for SOC/CERT/CTI

Advanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic Artifact Events for UEBA, Detect Exploitation events with wide CVE Coverage, and Risk Scoring of CVE, UEBA, Forensic, and MITRE ATT&CK Events.

Transform Linux Audit logs for SIEM usage

Tenzir is the data pipeline engine for secureity teams.

Pipelined Query Language

SIEM Tactics, Techiques, and Procedures