Alternatives and similar repositories for OSSIEM

Users that are interested in OSSIEM are comparing it to the libraries listed below

• socfortress / CoPilot
  SOCFortress CoPilot
  ☆354Updated this week
• socfortress / SOCFortress-Threat-Intel
  Integrate your Wazuh-Manager or Graylog with the SOCFortress Threat Intel Service
  ☆29Updated 11 months ago
• itiligent / Easy-OpenVAS-Installer
  2025 OpenVAS appliance install & upgrade scripts, includes https front end (self signed), authenticated SMB scanning & email reports
  ☆78Updated 6 months ago
• dLoProdz / OSSIEM
  Open Source SIEM Stack
  ☆26Updated 11 months ago
• ls111-cybersec / thehive-cortex-misp-docker-compose-lab11update
  ☆30Updated 2 years ago
• juaromu / wazuh-opencti
  ☆38Updated 2 years ago
• gbrigandi / mcp-server-wazuh
  MCP Server for Wazuh SIEM
  ☆116Updated 2 months ago
• branchnetconsulting / wazuh-tools
  Useful scripts for those administering Wazuh
  ☆86Updated last week
• WithSecureLabs / Kanvas
  A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.
  ☆366Updated last week
• MISP / misp-docker
  A production ready Dockered MISP
  ☆279Updated last week
• yevonnaelandrew / t-guard
  T-Guard Repository
  ☆17Updated last year
• tguard-soc-package / nusantara
  ☆217Updated last year
• socfortress / Wazuh-Rules
  Advanced Wazuh Rules for more accurate threat detection. Feel free to implement within your own Wazuh environment, contribute, or fork!
  ☆1,070Updated last month
• stanfrbd / cyberbro
  A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
  ☆454Updated last week
• bitorscanner / Bitor
  Bitor Scanning Software
  ☆407Updated last month
• socfortress / wazuh-mcp-server
  Repo to hold wazuh manager mcp server
  ☆56Updated last month
• utmstack / UTMStack
  Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
  ☆325Updated last week
• 3CORESec / testmynids.org
  A website and framework for testing NIDS detection
  ☆285Updated 2 months ago
• sudo-secxyz / OpenVulnScan
  A simple vulnerability scanning application built with FastAPI. vulnerability-scanner open-source-security nmap-cve SIEM
  ☆29Updated this week
• weslambert / velociraptor-docker
  Docker image for Velocidex Velociraptor
  ☆134Updated 6 months ago
• lawrencesystems / graylog_extractors
  ☆70Updated 4 months ago
• juaromu / wazuh-misp
  ☆19Updated 2 years ago
• zdhenard42 / SOC-Multitool
  A powerful and user-friendly browser extension that streamlines investigations for security professionals.
  ☆403Updated 4 months ago
• splunk / DECEIVE
  DECeption with Evaluative Integrated Validation Engine (DECEIVE): Let an LLM do all the hard honeypot work!
  ☆260Updated 3 months ago
• OpenAEV-Platform / docker
  OpenAEV Docker deployment helpers
  ☆23Updated this week
• bgenev / impulse-xdr
  Fully automated host & network intrusion detection platform. Detects malware from behavioural patterns rather than signatures and enables…
  ☆138Updated last year
• OpenCTI-Platform / docker
  OpenCTI Docker deployment helpers
  ☆203Updated this week
• shauntdergrigorian / splunkqueries
  A list of Splunk queries that I've collected and used over time.
  ☆86Updated 4 years ago
• activecm / rita
  Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis…
  ☆387Updated 3 weeks ago
• sguresearcher / nusantara
  ☆21Updated last week