quadrantsec / sagan
Sagan is a multi-threads, high performance log analysis engine. At it's core, Sagan similar to Suricata/Snort but with logs rather than network packets.
☆165Updated last week
Alternatives and similar repositories for sagan:
Users that are interested in sagan are comparing it to the libraries listed below
- Suricata rules for network anomaly detection☆156Updated 3 weeks ago
- DynamiteNSM is a free Network Security Monitor developed by Dynamite Analytics to enable network visibility and advanced cyber threat det…☆170Updated last year
- Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs an…☆387Updated last week
- Suricata Extreme Performance Tuning guide - Mark II☆115Updated 6 years ago
- Open source endpoint agent providing host information to Zeek. [v2]☆77Updated 4 months ago
- Suricata Verification Tests - Testing Suricata Output☆105Updated this week
- Open Source Security Information and event Management☆88Updated 9 years ago
- Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search☆448Updated this week
- The OTX Suricata Rule Generator can be used to create the rules and configuration for Suricata to alert on indicators from your OTX accou…☆108Updated 10 months ago
- A Ruleset to enhance detection capabilities of Ossec using Sysmon☆91Updated 2 years ago
- Security event correlation engine for ELK stack☆435Updated 8 months ago
- The tool for updating your Suricata rules.☆266Updated 3 months ago
- PcapMonkey will provide an easy way to analyze pcap using the latest version of Suricata and Zeek.☆151Updated last year
- ☆29Updated this week
- Open Source SIEM (Security Information and Event Management system).☆206Updated last year
- An open standard for hashing network flows into identifiers, a.k.a "Community IDs".☆176Updated 5 months ago
- Suricata Extreme Performance Tuning guide☆207Updated 6 years ago
- Zeek-Formatted Threat Intelligence Feeds☆353Updated this week
- 🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.☆262Updated last year
- Passive Real-time Asset Detection System☆233Updated 9 months ago
- An application allowing users to explore, create, annotate, and share extensions of the MITRE ATT&CK® knowledge base. This repository con…☆344Updated this week
- Tool for managing Zeek deployments.☆54Updated last week
- A curated list of awesome things related to Suricata☆156Updated last week
- The Security Analyst’s Guide to Suricata☆54Updated 9 months ago
- Convert pcap files into richly-typed ZNG summary logs (Zeek, Suricata, and more)☆79Updated 4 months ago
- This project is a SIEM with SIRP and Threat Intel, all in one.☆427Updated 3 months ago
- Meer is a "spooler" for Suricata / Sagan.☆29Updated last year
- Plugin providing native AF_Packet support for Zeek.☆34Updated 11 months ago
- Mapping NSM rules to MITRE ATT&CK☆70Updated 4 years ago
- Collection of various open-source an commercial rulesets for NIDS (especially for Suricata and Snort)☆23Updated last year