helixmap/sigwood

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

Rapidly Search and Hunt through Linux Forensics Artifacts

Logging Made Easy (LME) is a no cost, open source platform that centralizes log collection, enhances threat detection, and enables real-time alerting, helping small to medium-sized organizations secure their infrastructure. LME Docs can be found at https://cisagov.github.io/lme-docs/docs/

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Main Sigma Rule Repository