security-operations-center 开源项目推荐（182 个）

utmstack /UTMStack

由实时相关性和威胁情报提供支持的业务准备就绪SIEM、SOAR和合规性。

Vigil-SOC /vigil

Vigil - 一个持续改进的 100% 开源安全 AI 系统

SecurityClaw /SecurityClaw

A modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral memory, and validates real-time anomalies using LLMs.

MaheshShukla1 /SOC-Analyst-Notes

Comprehensive SOC Analyst notes covering incident response, threat hunting, SOC workflows, and cybersecurity concepts—perfect for exam prep and skill-building in blue team operations.

minhaj-313 /-Ultimate-Cybersecurity-Roadmap

Ultimate Cybersecurity Roadmap (2025 Edition) | Beginner to Advanced Guide | Learn Ethical Hacking, SOC Analysis, Threat Hunting, Incident Response, and More by Shaikh Minhaj (Cyber With Minhaj)

INFOKOM-KI /Wazuh-MCP-Server

Wazuh MCP Server: AI-Driven SOC Automation

Fausto-404 /EFF-Monitoring

EFF-Monitoring是一款面向安全运营场景的告警协作与 AI 研判平台。平台围绕安全事件全生命周期，提供AI研判、处置流转、经验沉淀、插件接入等能力，通过证据驱动的分析与协同机制，帮助安全团队快速看懂告警、定位风险、联动上下游并提升处置效率。

uruc /SOC-Automation-Lab

This project automates SOC workflows using Wazuh, Shuffle, and TheHive. It involves setting up a Windows 10 client with Sysmon and Ubuntu 22.04 for Wazuh and TheHive, deployed on cloud or VMs. Goals: automate event collection, alerting, and incident response to enhance SOC efficiency.

icdfa /soc-training-program

Certified SOC Analyst (CSA) Program - A comprehensive 6-month, hands-on Security Operations Center training curriculum. Developed by Aminu Idris, AMCPN | International Cybersecurity and Digital Forensics Academy (ICDFA)

quitehacker /MITRE-ATTACK-Enterprise-Matrix-in-Excel-for-SOC

The Enhanced MITRE ATT&CK® Coverage Tracker is an Excel tool for SOCs to measure and improve detection coverage of cyber threats. It simplifies tracking of security readiness against ATT&CK® tactics and techniques, offering a customizable, user-friendly interface for SOC analysts.

inthecyber-group /securityonion-n8n-workflows

Threat Intelligence Analysis workflows built with n8n and integrated in SecurityOnion

JoasASantos /NeuroPurple

The AI Autonomous SOC & Purple-Team Engine

0xbythesecond /Azure-SOC-Honeynet-Project

Built a mini HoneyNet in Azure and ingest log sources from various resources into a Log Analytics workspace

ZonWin /VulnFlanker

监测漏洞，快速评估内部资产受影响程度，并处置闭环。Monitor vulnerabilities, rapidly assess their impact on internal assets, and close-loop remediation

MrM8BRH /Defensive-Security-Hub

A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts.

asajid03 /Lets-Defend-Solutions

The "Let's-defend-solution" directory contains the answers to all paths of the Let's Defend platform that were saved by the creator 8 months ago. These answers can be used by others who want to learn and practice their skills in cybersecurity.

Cipherkrish69x /SOC-Analyst-Project

A comprehensive SOC Analyst project that includes detection rules, attack simulations, automated responses, and SIEM configuration.

Harshita0502 /SOC-HomeLab

A fully isolated, multi-VLAN Cybersecurity SOC Simulation Lab integrating pfSense firewall, Wazuh SIEM, Snort IDS/IPS, and target machines for realistic attack detection, log analysis, and threat simulation — designed to showcase professional detection engineering and network defense capabilities.

NONAN23x /SoC-Home-Lab

Yet another SoC Lab

MaheshShukla1 /Python-SOC-Security-notes

PythonSOCModules: Elevate your Security Operations Center (SOC) with Python's Paramiko, Requests, PyShark, Scapy, Matplotlib, and Seaborn modules. Strengthen security monitoring, incident detection, and response.