Defensive Security
Tools for SOC, IR, threat hunting, monitoring
16 tools in this category
Wazuh
C++ • GPL-2.0
Open-source XDR and SIEM that does agent-based threat detection, integrity monitoring and compliance across endpoints, containers and cloud
Security Onion
Python • MIT
Free IDS/NSM distro
Elastic SIEM
Multiple • MIT
SIEM on Elastic Stack
OpenCTI
Multiple • MIT
Threat intelligence platform
MISP
Multiple • MIT
Threat intel sharing platform
Grafana Loki
Multiple • MIT
Log aggregation for monitoring
Sigma HQ
Python • MIT
SIEM-agnostic detection rules
Suricata
C/Python • MIT
High-performance IDS/IPS
Snort
C++ • GPL-2.0
The original open-source network intrusion detection system — signature-based packet analysis with a rule language the industry learned on
Zeek
C/Python • MIT
Network analysis framework
Arkime
Multiple • MIT
Packet capture and search
Graylog
Multiple • MIT
Open-source log management
Shuffle
Multiple • MIT
Open-source SOAR platform
DFIR IRIS
Multiple • MIT
IR investigation platform
OpenVAS
C/Python • MIT
Open-source vulnerability scanner
Nessus Essentials
Python • MIT
Industry-standard vulnerability scanner