Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
☆4,896Sep 23, 2026Updated this week
Alternatives and similar repositories for securityonion
Users that are interested in securityonion are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.☆16,981Updated this week
- Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management☆3,135Apr 16, 2021Updated 5 years ago
- Main Sigma Rule Repository☆11,083Updated this week
- Digging Deeper....☆4,268Updated this week
- Open Cyber Threat Intelligence Platform☆10,035Updated this week
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.☆7,991Updated this week
- TheHive is a Collaborative Case Management Platform, now distributed as a commercial version☆3,949Jul 25, 2025Updated last year
- MISP (core software) - Open Source Threat Intelligence and Sharing Platform☆6,547Updated this week
- Small and highly portable detection tests based on MITRE's ATT&CK.☆12,575Sep 14, 2026Updated last week
- Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs an…☆2,527Updated this week
- Automated Adversary Emulation Platform☆7,288Aug 27, 2026Updated 3 weeks ago
- Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OIS…☆6,662Updated this week
- A Suricata based NDR distribution☆1,591Sep 13, 2025Updated last year
- IntelOwl: manage your Threat Intelligence at scale☆4,727Updated this week
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- 🍯 T-Pot - The All In One Multi Honeypot Platform 🐝☆9,520Updated this week
- The Hunting ELK☆3,929Jun 1, 2024Updated 2 years ago
- A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering env…☆9,058Jun 23, 2026Updated 3 months ago
- Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.☆3,360Sep 12, 2026Updated last week
- Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis…☆2,510Jan 12, 2026Updated 8 months ago
- A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more e…☆4,673Jan 12, 2026Updated 8 months ago
- Six Degrees of Domain Admin☆10,611Mar 2, 2026Updated 6 months ago
- ✨ A curated list of awesome threat detection and hunting resources 🕵️♂️☆4,731Jan 5, 2026Updated 8 months ago
- Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabl…☆31,459Updated this week
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Detect Tactics, Techniques & Combat Threats☆2,341Sep 14, 2026Updated last week
- A repository of sysmon configuration modules☆3,139Updated this week
- Automate the creation of a lab environment complete with security tooling and logging best practices☆5,028Jul 6, 2024Updated 2 years ago
- Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.☆2,442Updated this week
- ☆2,428Oct 14, 2023Updated 2 years ago
- Arkime is an open source, large scale, full packet capturing, indexing, and database system.☆7,474Updated this week
- A curated list of awesome YARA rules, tools, and people.☆4,273Jun 15, 2026Updated 3 months ago
- Rapidly Search and Hunt through Windows Forensic Artefacts☆3,670Updated this week
- Sysmon configuration file template with default high-quality event tracing☆5,655Jul 3, 2024Updated 2 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- ☆64Updated this week
- The FLARE team's open-source tool to identify capabilities in executable files.☆6,196Sep 14, 2026Updated last week
- Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mand…☆7,809Oct 16, 2025Updated 11 months ago
- Cortex: a Powerful Observable Analysis and Active Response Engine☆1,629Jun 30, 2026Updated 2 months ago
- This repository contains the scanner component for Greenbone Community Edition.☆4,836Updated this week
- ☆55Updated this week
- A curated list of tools for incident response☆9,405Jul 15, 2026Updated 2 months ago