Alternatives and similar repositories for OSSIEM

Users that are interested in OSSIEM are comparing it to the libraries listed below

• socfortress / CoPilot
  SOCFortress CoPilot
  ☆369Updated 2 weeks ago
• socfortress / OSSIEM
  Open Source SIEM Stack
  ☆124Updated 2 months ago
• socfortress / Wazuh-Rules
  Advanced Wazuh Rules for more accurate threat detection. Feel free to implement within your own Wazuh environment, contribute, or fork!
  ☆1,111Updated last week
• MISP / misp-docker
  A production ready Dockered MISP
  ☆285Updated last week
• madirish / ossocdocs
  Open Source Security Operations Center Documentation
  ☆195Updated 3 months ago
• tguard-soc-package / nusantara
  ☆218Updated last year
• alextibor / wazuh-fortigate-rules-decoders
  Decoders and Rules for Fortigate in Wazuh
  ☆49Updated last year
• juaromu / wazuh-opencti
  ☆39Updated 2 years ago
• socfortress / Playbooks
  Playbooks for SOC Analysts
  ☆603Updated 2 years ago
• branchnetconsulting / wazuh-tools
  Useful scripts for those administering Wazuh
  ☆86Updated 2 weeks ago
• WithSecureLabs / Kanvas
  A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.
  ☆380Updated last week
• socfortress / SOCFortress-Threat-Intel
  Integrate your Wazuh-Manager or Graylog with the SOCFortress Threat Intel Service
  ☆30Updated last year
• Bert-JanP / Incident-Response-Powershell
  PowerShell Digital Forensics & Incident Response Scripts.
  ☆707Updated last week
• utmstack / UTMStack
  Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
  ☆329Updated this week
• CrowdStrike / logscale-community-content
  This repository contains Community and Field contributed content for LogScale
  ☆282Updated this week
• ls111-cybersec / thehive-cortex-misp-docker-compose-lab11update
  ☆30Updated 2 years ago
• itiligent / Easy-OpenVAS-Installer
  2025 OpenVAS appliance install & upgrade scripts, includes https front end (self signed), authenticated SMB scanning & email reports
  ☆81Updated last week
• LoicVeirman / HardenAD
  Hardening Active Directory version 2
  ☆336Updated last month
• gbrigandi / mcp-server-wazuh
  MCP Server for Wazuh SIEM
  ☆124Updated 3 months ago
• shauntdergrigorian / splunkqueries
  A list of Splunk queries that I've collected and used over time.
  ☆86Updated 4 years ago
• weslambert / velociraptor-docker
  Docker image for Velocidex Velociraptor
  ☆137Updated 7 months ago
• cyb3rmik3 / KQL-threat-hunting-queries
  A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 D…
  ☆734Updated last month
• zdhenard42 / SOC-Multitool
  A powerful and user-friendly browser extension that streamlines investigations for security professionals.
  ☆404Updated 4 months ago
• Yamato-Security / EnableWindowsLogSettings
  Documentation and scripts to properly enable Windows event logs.
  ☆634Updated last week
• LoicVeirman / Hello-My-Dir
  This project is specifically made for brand new directory and ease their creation with all security rules in place.
  ☆112Updated 3 months ago
• securityjoes / MasterParser
  MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
  ☆741Updated last month
• Bert-JanP / Open-Source-Threat-Intel-Feeds
  This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple…
  ☆714Updated 8 months ago
• bayusky / wazuh-custom-rules-and-decoders
  In this projects are custom-decoders and custom-rules for Wazuh by me. Feel free to use it, you can redistribute it and/or modify it unde…
  ☆49Updated last month
• cisagov / LME
  Logging Made Easy (LME) is a no cost, open source platform that centralizes log collection, enhances threat detection, and enables real-t…
  ☆1,119Updated this week
• socfortress / iris-velociraptorartifact-module
  IRIS Module to Run Any Velociraptor Artifact
  ☆13Updated 2 years ago