cisagov / network-architecture-verification-and-validationLinks
The NAVV (Network Architecture Verification and Validation) tool creates a spreadsheet for network traffic analysis from PCAP data and Zeek logs, automating Zeek analysis of PCAP files, the collation of Zeek logs and the dissection of conn.log and dns.log to create a summary or network traffic in an XLSX-formatted spreadsheet.
☆35Updated last year
Alternatives and similar repositories for network-architecture-verification-and-validation
Users that are interested in network-architecture-verification-and-validation are comparing it to the libraries listed below
Sorting:
- Endpoint detection for remote hosts for consumption by RITA and Elasticsearch☆79Updated 3 months ago
- Sysmon and wazuh integration with Sigma sysmon rules [updated]☆71Updated 4 years ago
- Security Onion + Automation + Response Lab including n8n and Velociraptor☆112Updated 3 years ago
- Run Velociraptor on Security Onion☆40Updated 3 years ago
- Stand-Alone Windows Hardening (SAWH) is a script to reduce the attack surface of Windows systems that are not attached to a Windows Activ…☆55Updated 4 years ago
- DShield Sensor Log Collection with ELK☆44Updated this week
- Corelight@Home script☆45Updated 2 years ago
- A collection of tips for using MISP.☆75Updated last year
- ☆78Updated 2 weeks ago
- Integrate your Wazuh-Manager or Graylog with the SOCFortress Threat Intel Service☆32Updated last year
- Run zeek with zeekctl in docker☆62Updated last year
- ☆57Updated 3 years ago
- ☆61Updated last week
- SOARCA - The Open Source CACAO-based Security Orchestrator!☆100Updated last month
- ☆73Updated 9 months ago
- A Ruleset to enhance detection capabilities of Ossec using Sysmon☆94Updated 3 years ago
- Zeek Extension to Collect Metadata for Profiling of Endpoints and Proxies☆39Updated 4 months ago
- Digital Forensic Analysis and Incident Response Playbooks to handle real world security incidents☆50Updated last year
- ☆20Updated 4 years ago
- Docker image for Velocidex Velociraptor☆143Updated last month
- Roota is a public-domain language of threat detection and response that combines native queries from a SIEM, EDR, XDR, or Data Lake with …☆132Updated last year
- Extracts fields from zeek logs, compatible with zeek-cut☆25Updated last year
- Get started using Synapse Open-Source to start a Cortex and perform analysis within your area of expertise.☆49Updated 3 years ago
- Collection of useful Canary tools☆93Updated this week
- ☆74Updated 3 months ago
- The Infosec Community Definitive Guide to Jupyter Notebooks☆131Updated 5 years ago
- MITRE Engage™ is a framework for conducting Denial, Deception, and Adversary Engagements.☆67Updated last year
- Search a filesystem for indicators of compromise (IoC).☆82Updated last month
- an awesome list of active defense resources☆128Updated 5 years ago
- Leveraging MISP indicators via a pDNS-based infrastructure as a poor man’s SOC.☆56Updated 3 months ago