idaholab / Malcolm
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
☆362Updated this week
Related projects ⓘ
Alternatives and complementary repositories for Malcolm
- A set of Zeek scripts to detect ATT&CK techniques.☆565Updated 4 months ago
- Zeek-Formatted Threat Intelligence Feeds☆343Updated this week
- Configuration files for the SOF-ELK VM☆1,496Updated this week
- Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs an…☆1,970Updated this week
- MISP Docker (XME edition)☆283Updated 11 months ago
- Suricata, Snort and Zeek IDS rule and pcap testing system☆452Updated this week
- MISP trainings, threat intel and information sharing training materials with source code☆390Updated this week
- A utility to safely generate malicious network traffic patterns and evaluate controls.☆1,264Updated 7 months ago
- A knowledge base of actionable Incident Response techniques☆613Updated 2 years ago
- Zeek Log Cheatsheets☆285Updated 2 years ago
- SIEM Tactics, Techiques, and Procedures☆587Updated last month
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆681Updated this week
- Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search☆431Updated last week
- An application allowing users to explore, create, annotate, and share extensions of the MITRE ATT&CK® knowledge base. This repository con…☆325Updated this week
- Mapping the MITRE ATT&CK Matrix with Osquery☆776Updated last year
- Suricata rules for network anomaly detection☆154Updated 2 months ago
- Sophos-originated indicators-of-compromise from published reports☆546Updated 2 weeks ago
- ReversingLabs YARA Rules☆770Updated last month
- CyLR - Live Response Collection Tool☆646Updated 2 years ago
- MITRE Caldera™ for OT Plugins & Capabilities☆195Updated this week
- A production ready Dockered MISP☆169Updated last week
- Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders☆768Updated last year
- Python Script to access ATT&CK content available in STIX via a public TAXII server☆557Updated 5 months ago
- OpenCTI Connectors☆384Updated this week
- DFIRTrack - The Incident Response Tracking Application☆482Updated 2 months ago
- Docker image for MISP☆115Updated this week
- Cyber Incident Response Team Playbook Battle Cards☆359Updated 6 months ago
- Transform Linux Audit logs for SIEM usage☆712Updated 3 weeks ago
- Simple Bash IOC Scanner☆697Updated 2 years ago
- Set of SIGMA rules (>320) mapped to MITRE ATT&CK tactic and techniques☆310Updated 5 months ago