Tools
zeek
zeek/zeek
A powerful network security monitoring framework with deep protocol analyzers and a scripting language, used for traffic analysis, threat detection, and incident response.
Topics
Related projects
arkime7.6kArkime is a large-scale open-source full-packet capture, indexing, and analysis system that stores traffic as PCAP and offers a web interface for searching and exporting sessions.
suricata6.8kSuricata is an open-source network IDS, IPS, and security monitoring engine developed by the OISF, designed for high-performance analysis of live network traffic.
maltrail8.7kA malicious network traffic detection system that matches observed traffic against threat-intelligence trails and reports events through a web interface.
chainsaw3.7kChainsaw is a fast Rust command-line tool for threat hunting through Windows forensic artefacts, applying Sigma rules to event logs and analysing MFT and SRUM data.
chainsaw3.7kChainsaw is a fast, standalone CLI for Windows forensic triage. It searches event logs and MFT artefacts, applies Sigma and custom detection rules, and builds timelines for threat hunting and incident response.
timesketch3.4kTimesketch is an open-source, self-hosted platform for collaborative forensic timeline analysis, letting investigators upload event logs into sketches, annotate them, and search and visualize timelines together.