#siem (26 Repositories)
Ranked open-source repositories tagged with #siem, scored by pull request acceptance likelihood and maintainer engagement velocity.
41.0%
20.1h
26 repositories tagged #siem
utmstack/UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
timescale/rsigma
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
Graylog2/graylog2-server
Free and open log management
beenuar/AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
tenzir/tenzir
Tenzir is the data pipeline engine for security teams.
Karib0u/rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
gebruder/wirken
The enterprise gateway for autonomous agents. Identity management, per-channel isolation, credential vault, per-session tamper-evident audit log.
VictoriaMetrics/VictoriaLogs
Fast and easy to use database for logs, which can efficiently handle terabytes of logs
scalytics/kafSIEM
Entity graph platform for air-gapped defense and critical infrastructure. Kafka-native OSINT, OT fusion, and immutable provenance on every edge.
SigmaHQ/sigma
Main Sigma Rule Repository
FunnyWolf/agentic-soc-platform
Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)
dr4gon123/flasi
Fortinet and Palo Alto logs to VictoriaLogs and Elasticsearch
andreicscs/HoneyWire
HoneyWire: The Open-Source, Unlimited Deception Platform. Turn any Linux machine into an enterprise-grade canary in 60 seconds.
threathunters-io/laurel
Transform Linux Audit logs for SIEM usage
jaegeral/security-apis
A collective list of public APIs for use in security. Contributions welcome
depalmar/ai_for_the_win
Build AI-powered security tools. 50+ hands-on labs covering ML, LLMs, RAG, threat detection, DFIR, and red teaming. Includes Colab notebooks, Docker environment, and CTF challenges.
defenxor/dsiem
Security event correlation engine for ELK stack
mthcht/Purpleteam
Purpleteam scripts simulation & Detection - trigger events for SOC detections
strontic/xcyclopedia
Encyclopedia for Executables
eshlomo1/Microsoft-Sentinel-SecOps
Microsoft Sentinel SOC Operations
olafhartong/ATTACKdatamap
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
mdecrevoisier/EVTX-to-MITRE-Attack
Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.
mthcht/ThreatHunting-Keywords
Awesome list of keywords and artifacts for Threat Hunting sessions
pfelk/pfelk
pfSense/OPNsense + Elastic Stack
panther-labs/panther-analysis
Built-in Panther detection rules and policies
nsacyber/Event-Forwarding-Guidance
Configuration guidance for implementing collection of security relevant Windows Event Log events by using Windows Event Forwarding. #nsacyber