Awesome Cybersecurity Blue Team
Section: Threat hunting · All-in-one Free Software threat hunting stack based on Elasticsearch, Logstash, Kafka, and Kibana with various built-in integrations for analytics including Jupyter Notebook.
StaleScore 55
Entry
HELK
Appears in 5 awesome lists
All-in-one free threat hunting stack built on Elasticsearch, Logstash, Kafka, and Kibana with Jupyter Notebook integrations, designed by Roberto Rodriguez (Cyb3rWard0g) as a security data science suite for practicing hunting with pre-loaded attack datasets.
Open github.comcyb3rward0g/helk
Found in these lists
Awesome Cybersecurity Blue Team - CN
Section: 威胁狩猎 · 基于Elasticsearch，Logstash，Kafka和Kibana的多合一免费软件威胁狩猎套件，并具有包括Jupyter Notebook在内的各种内置集成分析功能
StaleScore 49
Awesome Incident Response
Section: Other Tools · Threat Hunting platform.
FreshScore 89
Awesome Threat Detection and Hunting
Section: Tools · A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.
SlowScore 57
Hacking Tools
Section: Threat Hunting · All-in-one free threat hunting stack built on Elasticsearch, Logstash, Kafka, and Kibana with Jupyter Notebook integrations, designed by Roberto Rodriguez (Cyb3rWard0g) as a security data science suite for practicing hunting with pre-loaded attack datasets.
FreshScore 91
Often listed next to it
GRR Rapid Response
Incident response framework focused on remote live forensics. It consists of a python agent (client) that is installed on target systems, and a python server infrastructure that can manage and talk to the agent. Besides the included Python API client, PowerGRR provides an API client library in…
In 7 listsDetails
PowerForensics
All in one PowerShell-based platform to perform live hard disk forensic analysis.
In 6 listsDetails
Stenographer
Packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. It stores as much history as it possible, managing disk usage, and deleting when disk limits are hit. It's ideal for capturing the traffic just before and during…
In 5 listsDetails
DeepBlueCLI
PowerShell module for hunt teaming via Windows Event logs, enabling rapid triage of security events directly from PowerShell without a full SIEM deployment.
In 4 lists
rastrea2r
Multi-platform tool for triaging suspected IOCs on many endpoints simultaneously and that integrates with antivirus consoles.
In 4 lists
Redline
Provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis, and the development of a threat assessment profile.
In 4 lists
CimSweep
A suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows
In 4 lists
Raccine
A Simple Ransomware Protection
In 3 lists