Alternatives and similar repositories for aaalm

Users that are interested in aaalm are comparing it to the libraries listed below

• theparanoids / spicy-noise
  A Spicy protocol analyzer for WireGuard
  ☆29Updated 5 years ago
• corelight / zeek-community-id
  Zeek support for Community ID flow hashing.
  ☆37Updated 2 years ago
• IQTLabs / packet_cafe
  A platform built for easy-to-use automated network traffic analysis
  ☆59Updated 2 years ago
• zeek / zeek-agent
  This project is no longer maintained. There's a successor at https://github.com/zeek/zeek-agent-v2
  ☆123Updated 4 years ago
• ccdcoe / CDMCS
  Cyber Defence Monitoring Course Suite :: Suricata, Arkime (and others in the past)
  ☆107Updated last year
• spitfire55 / MegaDev
  Bro IDS + ELK Stack to detect and block data exfiltration
  ☆46Updated 6 years ago
• alphasoc / nfr
  A lightweight tool to score network traffic and flag anomalies
  ☆123Updated last year
• regit / suriwire
  Wireshark plugin to display Suricata analysis info
  ☆95Updated 3 years ago
• rocknsm / rock-scripts
  Bro scripts for the ROCK platform. http://rocknsm.io
  ☆34Updated 2 years ago
• corelight / json-streaming-logs
  Bro script package to create JSON formatted logs to stream into data analysis systems.
  ☆29Updated last year
• rocknsm / rock-dashboards
  Dashboards and loader for ROCK NSM dashboards
  ☆49Updated 2 years ago
• CIRCL / potiron
  Potiron - Normalize, Index and Visualize Network Capture
  ☆87Updated 6 years ago
• rocknsm / docket
  A RESTful API frontend for Stenographer
  ☆54Updated 2 years ago
• zeek / zeek-osquery
  Bro/Zeek integration with osquery
  ☆94Updated 4 years ago
• ncsa / bro-doctor
  ☆24Updated 5 years ago
• Yara-Rules / yara-endpoint
  Yara-Endpoint is a tool useful for incident response as well as anti-malware enpoint base on Yara signatures.
  ☆110Updated 7 years ago
• capesstack / capes
  Cyber Analytics Platform and Examination System (CAPES) Project Page
  ☆60Updated 6 years ago
• MISP / mail_to_misp
  Connect your mail client/infrastructure to MISP in order to create events based on the information contained within mails.
  ☆69Updated last year
• tylabs / dovehawk
  Dovehawk is a Zeek module that automatically imports MISP indicators and reports Sightings
  ☆122Updated 4 years ago
• DCSO / balboa
  server for indexing and querying passive DNS observations
  ☆47Updated 3 months ago
• hosom / bro-otx
  Integrate Zeek with Alienvault OTX
  ☆25Updated 5 years ago
• JustinAzoff / flow-indexer
  Flow-Indexer indexes flows found in chunked log files from bro,nfdump,syslog, or pcap files
  ☆44Updated last year
• micrictor / spl-spt
  Zeek plugin to generate data on per-packet sizes and intervals
  ☆14Updated 5 years ago
• MattCarothers / mhn-core-docker
  Core elements of the Modern Honey Network implemented in Docker
  ☆34Updated 3 years ago
• corelight / cve-2021-44228
  Log4j Exploit Detection Logic for Zeek
  ☆19Updated last year
• zeek / zeek-agent-framework
  This project is no longer maintained. There's a successor at https://github.com/zeek-packages/zeek-agent-v2
  ☆14Updated 5 years ago
• Cisco-Talos / Daemonlogger
  The Official Github Repository of Daemonlogger
  ☆22Updated 4 years ago
• 0xtf / testmynids.org
  A website and framework for testing NIDS detection
  ☆57Updated 4 years ago
• idaholab / STIG
  Structured Threat Intelligence Graph
  ☆97Updated last week
• corelight / community-id-spec
  An open standard for hashing network flows into identifiers, a.k.a "Community IDs".
  ☆187Updated last year