#siem

Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)

Build AI-powered security tools. 50+ hands-on labs covering ML, LLMs, RAG, threat detection, DFIR, and red teaming. Includes Colab notebooks, Docker environment, and CTF challenges.

Exports OTLP metrics and logs from Microsoft Entra ID, Intune, Defender, M365 and Purview via Microsoft Graph, Azure Storage blobs and the O365 Management Activity API. Single Go binary, Grafana Cloud ready.

Security monitoring for small cloud operators. AI-native, self-hosted, Go. 17 detectors into an LLM investigation cascade.

Console-IR. OCSF-native incident response and investigation TUI for the terminal. Triage findings, pivot on indicators, investigate hosts and accounts, GeoIP and WHOIS enrichment, case management, write the report. Single Go binary, SQLite, no server. Open Cybersecurity Schema Framework security tooling for SOC analysts and DFIR.

Network dependent Sudo session logger and logplayback GUI

NIS2 security-event emitter — one standard shape for auth, authorization, proof, egress and secret-handling events shipped to a SIEM

Open source log management, detection, and collaboration