Kunai
Kunai is a Linux-based system monitoring tool that provides real-time monitoring and threat hunting capabilities. It collects and correlates system events, allowing for advanced threat detection and incident response. Kunai is designed to work seamlessly with Linux namespaces and container technologies, providing visibility into containerized environments. Kunai's kernel components are written in eBPF and run as probes, collecting relevant information for security monitoring. The collected data is then passed to a userland program for re-ordering, enriching, and correlating events. Kunai is built using Rust and the Aya library, and is available as a standalone binary that includes both the eBPF probes and the userland program. Kunai provides a range of features, including event sorting, on-host correlation, and event enrichment. It also supports Linux namespaces and container technologies, allowing for monitoring of containerized environments. Kunai is designed to be highly customizable, with a focus on ease of use and scalability. Kunai is available under an open-source license and is compatible with a wide range of Linux distributions.
FEATURES
ALTERNATIVES
Advanced Endpoint Protection is a complete endpoint protection platform that provides advanced threat protection against ransomware, data breaches, and malware.
Unified defense platform providing endpoint protection, extended detection and response, threat hunting, and digital forensics and incident response.
Toolkit for building custom minimal, immutable Linux distributions with secure defaults.
Cloud-based virus scan APIs for securing files, URLs, and content uploads with advanced anti-virus and malware scanning capabilities.
An endpoint monitoring tool for Linux and macOS that reports file, socket, and process events to Zeek.
Android Loadable Kernel Modules for reversing and debugging on controlled systems/emulators.
YARA-Endpoint is a client-server architecture tool that can be used for endpoint protection and incident response.
Heimdal Enterprise provides a unified cybersecurity platform with advanced network and endpoint security solutions, including threat hunting and privileged access management.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
CTIChef.com Detection Feeds
A tiered cyber threat intelligence service providing detection rules from public repositories with varying levels of analysis, processing, and guidance for security teams.
ImmuniWeb® Discovery
ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.