Alternatives and similar repositories for RELK

Users that are interested in RELK are comparing it to the libraries listed below

• corelight / ecs-mapping
  Mapping Corelight or Zeek data to Elastic Common Schema fields
  ☆34Updated last month
• tiburon-security / sriracha-iq
  Rapid cybersecurity toolkit based on Elastic in Docker. Designed to quickly build elastic-based environments to analyze and execute threa…
  ☆18Updated 5 years ago
• dgunter / ParseZeekLogs
  Utility for parsing Bro log files into CSV or JSON format
  ☆42Updated 2 years ago
• neu5ron / TMInfosec
  Repository of all the sites related to infosec IP/Domain/Hash/SSL/etc OSINT and eventually will include more.
  ☆69Updated last month
• corelight / got_zoom
  A Zeek package that detects Zoom logins and meeting joins
  ☆12Updated 5 years ago
• neu5ron / es_stk
  ☆13Updated 3 years ago
• OTRF / openhunt
  ☆35Updated 4 years ago
• spitfire55 / MegaDev
  Bro IDS + ELK Stack to detect and block data exfiltration
  ☆46Updated 7 years ago
• CityBaseInc / SIAC
  SIAC is an enterprise SIEM built on open-source technology.
  ☆116Updated 7 years ago
• Kirtar22 / ATTACK-Threat_Intel
  Graph Representation of MITRE ATT&CK's CTI data
  ☆50Updated 6 years ago
• nccgroup / JA3_outlier
  Incremental Machine Leaning by example - Detecting suspicious activity in real time with Zeek data streams, River and JA3 hashes
  ☆15Updated 3 years ago
• binorassocies / brostash
  brostash: Linux distribution based on Debian and focusing on network security events collection
  ☆34Updated 5 years ago
• CIRCL / potiron
  Potiron - Normalize, Index and Visualize Network Capture
  ☆88Updated 6 years ago
• tatsuiman / rpot2
  Real-time Packet Observation Tool
  ☆39Updated 2 years ago
• MISP / misp-packer
  Build Automated Machine Images for MISP
  ☆29Updated 2 years ago
• dogoncouch / siemstress
  Very basic CLI SIEM (Security Information and Event Management system).
  ☆42Updated 7 years ago
• opendns / pyinvestigate
  Python module to interface with the OpenDNS Investigate API
  ☆64Updated 3 years ago
• corelight / zeek-long-connections
  Zeek package for tracking long connections to report them before they have completed.
  ☆31Updated last week
• BreakingMalwareResearch / YetiToElastic
  YETI (Your Everyday Threat Intelligence) Integration to Elastic Stack
  ☆16Updated 4 years ago
• MISP / best-practices-in-threat-intelligence
  Best practices in threat intelligence
  ☆49Updated 3 years ago
• PUNCH-Cyber / stoq-plugins-public
  stoQ Public Plugins
  ☆71Updated 2 years ago
• corelight / zeek-community-id
  Zeek support for Community ID flow hashing.
  ☆37Updated 2 years ago
• OTRF / notebooks-forge
  A collection of notebooks built for defensive and offensive operations.
  ☆77Updated 5 years ago
• NVISOsecurity / ee-outliers
  Open-source framework to detect outliers in Elasticsearch events
  ☆209Updated 2 years ago
• DearBytes / Opensource-Endpoint-Monitoring
  This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.
  ☆35Updated 6 years ago
• hosom / bro-otx
  Integrate Zeek with Alienvault OTX
  ☆25Updated 5 years ago
• MISP / intelligence-icons
  intelligence-icons is a collection of icons and diagrams for building training and marketing materials around Intelligence sharing; inclu…
  ☆41Updated 6 years ago
• lprat / logstash-plugins
  My logstash plugins. Filter: sig (for security detect -> IOC, sig, New value, Reference, link, frequence, ...). Output: alert created by …
  ☆10Updated 6 years ago
• egaus / malicious_url_analysis
  ☆18Updated 7 years ago
• mitre / caret
  CARET - A tool for viewing cyber analytic relationships
  ☆55Updated 5 years ago