PyPI
panther-labs/panther-analysis
Built-in Panther detection rules and policies
Apache-2.0Sep 11, 2026 · metrics 2.10.0
All tags
Catalogue tag
#siem
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
22 records
Go
VictoriaMetrics/VictoriaLogs
Fast and easy to use database for logs, which can efficiently handle terabytes of logs
Apache-2.0Sep 20, 2026 · metrics 2.10.0
PyPI
wazuh/wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Custom licenseSep 20, 2026 · metrics 2.10.0
PyPI · Go · npm
beenuar/AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
MITOct 22, 2026 · metrics 2.10.0
PyPI
tenzir/tenzir
Tenzir is the data pipeline engine for security teams.
BSD-3-ClauseSep 15, 2026 · metrics 2.10.0
Go · Maven · npm
utmstack/UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
AGPL-3.0Sep 14, 2026 · metrics 2.10.0
crates.io
Karib0u/rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
Apache-2.0Sep 16, 2026 · metrics 2.10.0
PyPI
blitzcrieg1/agentmetry
Local-first endpoint sensor for AI coding agents. Hash-chained audit trail, MITRE-mapped sequence detection, DLP. Forwards to the SIEM you already run.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go · npm
scalytics/kafSIEM
Entity graph platform for air-gapped defense and critical infrastructure. Kafka-native OSINT, OT fusion, and immutable provenance on every edge.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
PyPI · npm
FunnyWolf/agentic-soc-platform
Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)
No licenseSep 16, 2026 · metrics 2.10.0
PyPI
depalmar/ai_for_the_win
Build AI-powered security tools. 50+ hands-on labs covering ML, LLMs, RAG, threat detection, DFIR, and red teaming. Includes Colab notebooks, Docker environment, and CTF challenges.
Custom licenseSep 16, 2026 · metrics 2.10.0
Go
rknightion/graph2otel
Exports OTLP metrics and logs from Microsoft Entra ID, Intune, Defender, M365 and Purview via Microsoft Graph, Azure Storage blobs and the O365 Management Activity API. Single Go binary, Grafana Cloud ready.
AGPL-3.0Sep 18, 2026 · metrics 2.10.0
Go
mallcop-app/mallcop
Security monitoring for small cloud operators. AI-native, self-hosted, Go. 17 detectors into an LLM investigation cascade.
MITSep 8, 2026 · metrics 2.10.0
Go
Ashfaaq98/ocsf-console-ir
Console-IR. OCSF-native incident response and investigation TUI for the terminal. Triage findings, pivot on indicators, investigate hosts and accounts, GeoIP and WHOIS enrichment, case management, write the report. Single Go binary, SQLite, no server. Open Cybersecurity Schema Framework security tooling for SOC analysts and DFIR.
AGPL-3.0Sep 19, 2026 · metrics 2.10.0
Go
alun-hub/sudo-logger
Network dependent Sudo session logger and logplayback GUI
AGPL-3.0Oct 20, 2026 · metrics 2.10.0
Go
gmb-lib/go-sec-events
NIS2 security-event emitter — one standard shape for auth, authorization, proof, egress and secret-handling events shipped to a SIEM
MITSep 13, 2026 · metrics 2.10.0
Go · npm · PyPI
zaneGittins/bifract
Open source log management, detection, and collaboration
AGPL-3.0Sep 24, 2026 · metrics 2.10.0
Go
CraftedSignal/kql-parser
Go parser for Kusto Query Language (KQL) - extracts conditions, fields, and tables from KQL queries
AGPL-3.0Sep 28, 2026 · metrics 2.10.0
Go
alephnull-sh/deadair
Finds the detection rules in your SIEM that are running blind
Apache-2.0Sep 18, 2026 · metrics 2.10.0
—
pfelk/pfelk
pfSense/OPNsense + Elastic Stack
Custom licenseSep 16, 2026 · metrics 2.10.0
crates.io · npm
timescale/rsigma
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
MITSep 18, 2026 · metrics 2.10.0
—
mthcht/ThreatHunting-Keywords
Awesome list of keywords and artifacts for Threat Hunting sessions
No licenseSep 16, 2026 · metrics 2.10.0