idaholab / Malcolm
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
☆405Updated this week
Alternatives and similar repositories for Malcolm
Users that are interested in Malcolm are comparing it to the libraries listed below
Sorting:
- A set of Zeek scripts to detect ATT&CK techniques.☆589Updated 10 months ago
- Transform Linux Audit logs for SIEM usage☆763Updated this week
- Zeek-Formatted Threat Intelligence Feeds☆361Updated this week
- Mapping the MITRE ATT&CK Matrix with Osquery☆791Updated 2 years ago
- Configuration files for the SOF-ELK VM☆1,583Updated last month
- Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders☆903Updated last year
- MISP Docker (XME edition)☆282Updated last year
- Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs an…☆2,118Updated this week
- Cortex Analyzers Repository☆460Updated last week
- Suricata, Snort and Zeek IDS rule and pcap testing system☆477Updated 4 months ago
- Cyber Analytics Repository☆937Updated this week
- An application allowing users to explore, create, annotate, and share extensions of the MITRE ATT&CK® knowledge base. This repository con…☆354Updated last week
- A Splunk app mapped to MITRE ATT&CK to guide your threat hunts☆1,156Updated last year
- UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It …☆965Updated 3 weeks ago
- SIEM Tactics, Techiques, and Procedures☆627Updated last week
- Zeek Log Cheatsheets☆291Updated 2 years ago
- A (nearly) production ready Dockered MISP☆231Updated last year
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆712Updated last month
- Scirius is a web application for Suricata ruleset management and threat hunting.☆649Updated last month
- DFIRTrack - The Incident Response Tracking Application☆498Updated 8 months ago
- This content is analysis and research of the data sources currently listed in ATT&CK.☆409Updated last year
- Cortex: a Powerful Observable Analysis and Active Response Engine☆1,422Updated 6 months ago
- Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by devel…☆607Updated last week
- Documentation of Cortex☆174Updated last year
- Actionable analytics designed to combat threats☆984Updated 2 years ago
- This project is a SIEM with SIRP and Threat Intel, all in one.☆437Updated 5 months ago
- Online hash checker for Virustotal and other services☆825Updated last month
- A knowledge base of actionable Incident Response techniques☆635Updated 2 years ago
- Open Source Security Events Metadata (OSSEM)☆1,266Updated 2 years ago
- Re-play Security Events☆1,641Updated last year