nfdump
0 (0)
A toolset for collecting and processing netflow/ipfix and sflow data from netflow/sflow compatible devices.
Synthetic Adversarial Log Objects (SALO) is a framework for the generation of log events without the need for infrastructure or actions to initiate the event that causes a log event. The purpose of this framework is to allow security practitioners, data scientists, and researchers the ability to create log events in a simple, repeatable, and randomized way without the overhead of traditional required resources. In the past, in order to generate simple network security logs, such as DNS queries for a malicious domain, it would be required to build one or more servers, as well as a network monitoring solution to capture events. Additionally, the DNS queries would have to be sent to a resolver with no simple way to construct custom requests or responses. This process can be time consuming, present technical and financial hurdles, and be extremely cumbersome or difficult to accomplish. This is especially so for more complex scenarios that may require highly technical deployments of software, services, and/or cloud native technology. SALO seeks to simplify the task of creating and co
A toolset for collecting and processing netflow/ipfix and sflow data from netflow/sflow compatible devices.
Security-Guard helps secure microservices and serverless containers by detecting and blocking exploits.
AlienVault OSSIM provides an all-in-one security management solution with asset discovery, vulnerability assessment, and SIEM capabilities.
RedELK enhances Red Team operations with SIEM capabilities to monitor and alert on Blue Team activities.
SysmonSearch makes event log analysis more effective by aggregating Microsoft Sysmon logs and providing detailed analysis through Elasticsearch and Kibana.
A pure Python parser for Windows Event Log files with access to File and Chunk headers, record templates, and event entries.