network-security-monitoring 开源项目推荐（96 个）

Security-Onion-Solutions /security-onion

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management

rafael-santiago /pig

A Linux packet crafting tool.

codeexpress /respounder

Respounder detects presence of responder in the network.

corelight /community-id-spec

An open standard for hashing network flows into identifiers, a.k.a "Community IDs".

0xtf /nsm-attack

Mapping NSM rules to MITRE ATT&CK

mytechnotalent /Zeek-Network-Security-Monitor

A Zeek Network Security Monitor tutorial that will cover the basics of creating a Zeek instance on your network in addition to all of the necessary hardware and setup and finally provide some examples of how you can use the power of Zeek to have absolute control over your network.

0xtf /testmynids.org

A website and framework for testing NIDS detection

dgunter /ParseZeekLogs

Read Zeek (Bro) logs into typed Python records; convert to JSON or CSV, map to Elastic Common Schema, load into Elasticsearch.

edoardottt /boggart

Highly customizable low-interaction experimental honeypot that mimics specific hosts.

tatsuiman /rpot2

Real-time Packet Observation Tool

HankLEE-1 /AI-Guardian

基于Agent驱动的网络安全流量监控与分析平台，下一代AI驱动的安全运营协作平台 — 智能告警研判、资产关联、协同处置与自动化报告生成，为护网行动增添一把利器。

3CORESec /AWS-AutoMirror

Automation of VPC Traffic Mirror Sessions in AWS

jxnet /Jxnet

Jxnet is a Java library for capturing and sending custom network packet buffers with no copies. Jxnet wraps a native packet capture library (libpcap/winpcap/npcap) via JNI (Java Native Interface).

alonecoder1337 /Dos-Attack-Detection-using-Machine-Learning

A machine learning program, that detects denial of service attack using machine learning technique.

corelight /pycommunityid

A Python implementation of the Community ID flow hashing standard

satta /gommunityid

Go implementation of the Community ID flow hashing standard

dgunter /Blog-Code

Jupyter notebooks from the Threat Hunting with Python series: hunting Nmap in Bro HTTP logs and dissecting MS SQL TDS traffic, with the original posts preserved

3CORESec /AWS-Mirror-Toolkit

A set of tools and procedures for automating NSM and NIDS deployments in AWS

Truvis /Splunk_TA_Truvis_Suricata5

This TA takes Suricata5 data from your port mirrored Suricata server and makes it readable within Splunk. See Cheatsheets on how to setup a Suricata Port Mirrored Server

3CORESec /AWS-TMS-Remover

Automate the deletion of AWS VPC Traffic Mirror Sessions