ethack/tht

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

Microsoft Threat Intelligence Security Tools

Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.

Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!

A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

Security Analytics enables users for detecting security threats on their security event log data. It will also allow them to modify/tailor the pre-packaged solution.