Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
☆4,964Nov 2, 2026Updated this week
Alternatives and similar repositories for securityonion
Users that are interested in securityonion are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.☆17,528Updated this week
- Digging Deeper....☆4,406Updated this week
- Main Sigma Rule Repository☆11,391Updated this week
- Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.☆8,164Updated this week
- Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management☆3,135Apr 16, 2021Updated 5 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Open Cyber Threat Intelligence Platform☆10,250Updated this week
- MISP (core software) - Open Source Threat Intelligence and Sharing Platform☆6,638Updated this week
- Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OIS…☆6,803Updated this week
- Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs an…☆2,577Updated this week
- Small and highly portable detection tests based on MITRE's ATT&CK.☆12,756Updated this week
- TheHive is a Cybersecurity Incident Response Management (CIRM) platform, now distributed commercially. Learn more on the official website…☆3,949Jul 25, 2025Updated last year
- Automated Adversary Emulation Platform☆7,485Oct 12, 2026Updated 3 weeks ago
- IntelOwl: manage your Threat Intelligence at scale☆4,780Updated this week
- 🍯 T-Pot - The All In One Multi Honeypot Platform 🐝☆9,685Updated this week
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A Suricata based NDR distribution☆1,591Sep 13, 2025Updated last year
- Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.☆3,433Updated this week
- Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.☆2,466Oct 27, 2026Updated last week
- Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hack…☆6,839Updated this week
- Tools and Techniques for Blue Team / Incident Response☆4,556Aug 23, 2026Updated 2 months ago
- A curated list of tools for incident response☆9,525Oct 13, 2026Updated 3 weeks ago
- A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering env…☆9,260Oct 7, 2026Updated 3 weeks ago
- ✨ A curated list of awesome threat detection and hunting resources 🕵️♂️☆4,780Jan 5, 2026Updated 9 months ago
- Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabl…☆32,539Updated this week
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- The Hunting ELK☆3,934Jun 1, 2024Updated 2 years ago
- A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more e…☆4,706Jan 12, 2026Updated 9 months ago
- Rapidly Search and Hunt through Windows Forensic Artefacts☆3,704Oct 14, 2026Updated 2 weeks ago
- This repository contains the scanner component for Greenbone Community Edition.☆4,914Updated this week
- Sysmon configuration file template with default high-quality event tracing☆5,719Jul 3, 2024Updated 2 years ago
- Adversary Emulation Framework☆12,219Oct 26, 2026Updated last week
- Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis…☆2,511Jan 12, 2026Updated 9 months ago
- Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, M…☆4,135Sep 22, 2026Updated last month
- Six Degrees of Domain Admin☆10,624Mar 2, 2026Updated 8 months ago
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ …☆11,512Oct 27, 2026Updated last week
- The FLARE team's open-source tool to identify capabilities in executable files.☆6,295Updated this week
- A curated list of awesome YARA rules, tools, and people.☆4,313Jun 15, 2026Updated 4 months ago
- Arkime is an open source, large scale, full packet capturing, indexing, and database system.☆7,554Updated this week
- Malware Configuration And Payload Extraction☆3,645Updated this week
- A repository of sysmon configuration modules☆3,182Oct 14, 2026Updated 2 weeks ago
- Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mand…☆7,829Oct 16, 2025Updated last year