Alternatives and similar repositories for S1EM:

Users that are interested in S1EM are comparing it to the libraries listed below

• mdecrevoisier / EVTX-to-MITRE-Attack
  Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
  ☆558Updated 2 months ago
• wagga40 / Zircolite
  A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
  ☆704Updated last month
• Hestat / ossec-sysmon
  A Ruleset to enhance detection capabilities of Ossec using Sysmon
  ☆91Updated 2 years ago
• TonyPhipps / SIEM
  SIEM Tactics, Techiques, and Procedures
  ☆616Updated last month
• TheHive-Project / Docker-Templates
  Docker configurations for TheHive, Cortex and 3rd party tools
  ☆119Updated 2 years ago
• cyb3rfox / Aurora-Incident-Response
  Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
  ☆892Updated last year
• CriticalPathSecurity / Zeek-Intelligence-Feeds
  Zeek-Formatted Threat Intelligence Feeds
  ☆356Updated this week
• guardsight / gsvsoc_cirt-playbook-battle-cards
  Cyber Incident Response Team Playbook Battle Cards
  ☆373Updated 10 months ago
• mdecrevoisier / SIGMA-detection-rules
  Set of SIGMA rules (>350) mapped to MITRE ATT&CK tactic and techniques
  ☆352Updated 2 months ago
• dfir-iris / iris-web
  Collaborative Incident Response platform
  ☆1,164Updated this week
• mthcht / ThreatHunting-Keywords
  Awesome list of keywords and artifacts for Threat Hunting sessions
  ☆553Updated 3 weeks ago
• lucky-luk3 / Grafiki
  Threat Hunting tool about Sysmon and graphs
  ☆330Updated last year
• cyberdefenders / DetectionLabELK
  DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
  ☆552Updated 3 years ago
• OpenCTI-Platform / docker
  OpenCTI Docker deployment helpers
  ☆178Updated last week
• coolacid / docker-misp
  A (nearly) production ready Dockered MISP
  ☆231Updated last year
• executemalware / Malware-IOCs
  ☆514Updated 5 months ago
• MISP / misp-training
  MISP trainings, threat intel and information sharing training materials with source code
  ☆403Updated last month
• stuhli / awesome-event-ids
  Collection of Event ID ressources useful for Digital Forensics and Incident Response
  ☆611Updated 9 months ago
• center-for-threat-informed-defense / attack-workbench-frontend
  An application allowing users to explore, create, annotate, and share extensions of the MITRE ATT&CK® knowledge base. This repository con…
  ☆346Updated last week
• atc-project / atc-react
  A knowledge base of actionable Incident Response techniques
  ☆632Updated 2 years ago
• Securonix / AutonomousThreatSweeper
  Threat Hunting queries for various attacks
  ☆229Updated this week
• correlatedsecurity / Awesome-SOAR
  A curated Cyber "Security Orchestration, Automation and Response (SOAR)" awesome list.
  ☆854Updated 7 months ago
• atc-project / atomic-threat-coverage
  Actionable analytics designed to combat threats
  ☆982Updated 2 years ago
• TheHive-Project / Cortex-Analyzers
  Cortex Analyzers Repository
  ☆450Updated last week
• OpenCTI-Platform / connectors
  OpenCTI Connectors
  ☆421Updated this week
• center-for-threat-informed-defense / tram
  TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE AT…
  ☆478Updated last week
• dfirtrack / dfirtrack
  DFIRTrack - The Incident Response Tracking Application
  ☆492Updated 6 months ago
• splunk / attack_data
  A repository of curated datasets from various attacks
  ☆630Updated this week
• defenxor / dsiem
  Security event correlation engine for ELK stack
  ☆435Updated 9 months ago
• TheHive-Project / awesome
  A curated list of awesome things related to TheHive & Cortex
  ☆177Updated 3 years ago