blookot / rsa2elkLinks
Converts Netwitness log parser configuration to Logstash configuration
☆20Updated 5 years ago
Alternatives and similar repositories for rsa2elk
Users that are interested in rsa2elk are comparing it to the libraries listed below
Sorting:
- Threat Intelligence with Elastic - Minemeld integration with Elasticsearch☆19Updated 4 years ago
- This repository contains a few examples of actions that can be added to rules within Elastic Security.☆24Updated 10 months ago
- Mapping Corelight or Zeek data to Elastic Common Schema fields☆34Updated last month
- Corelight-Ansible-Roles are a collection of Ansible Roles and playbooks that install, configure, run and manage a variety of Corelight, S…☆16Updated 4 years ago
- ansible role to setup MISP, Malware Information Sharing Platform & Threat Sharing☆54Updated last week
- Ansible playbook for installing MineMeld on Linux☆48Updated 4 years ago
- Read only mirror. To contribute or submit issues, please go to the website link --->☆15Updated 2 years ago
- MineMeld nodes for MISP☆19Updated last year
- An Ansible playbook for deploying the Suricata intrusion detection system and fetching Snort rules with Oinkmaster.☆17Updated 4 years ago
- ☆38Updated 6 years ago
- WebUI of MineMeld☆43Updated 2 years ago
- Parse wazuh[HIDS] alerts into ECS mapping using Filebeat☆28Updated 5 years ago
- SIEM Logstash parsing for more than hundred technologies☆189Updated last week
- This TA takes Suricata5 data from your port mirrored Suricata server and makes it readable within Splunk. See Cheatsheets on how to setup…☆15Updated 5 years ago
- A collection of Cortex Analyzers and Responders for TheHive/Cortex☆13Updated 5 years ago
- Bro script package to create JSON formatted logs to stream into data analysis systems.☆30Updated 3 weeks ago
- This package allows the use of a custom Elastalert Alert which creates alerts with observables in TheHive using TheHive4Py.☆27Updated 4 years ago
- Translate an ECS mapping CSV to starter pipelines for Beats, Elasticsearch or Logstash☆54Updated 3 years ago
- Run zeek with zeekctl in docker☆61Updated last year
- Elastic Beat for fetching and shipping Office 365 audit events☆68Updated 5 years ago
- Synthetic Adversarial Log Objects: A Framework for synthentic log generation☆85Updated last year
- A search command for Splunk which will allow you to search Elastic Search and display the results in the Splunk GUI☆69Updated 4 months ago
- ☆18Updated 3 years ago
- Wazuh - Splunk App☆56Updated last year
- Zeek support for Community ID flow hashing.☆37Updated 2 years ago
- Kestrel Jupyter Notebook Kernel☆10Updated 2 years ago
- ☆52Updated last week
- Example configuration files for Logstash☆44Updated 6 years ago
- ☆12Updated 5 years ago
- Technical add-on for Splunk related to TheHive/Cortex from TheHive project☆53Updated 3 months ago