medhy35 / open_source_security_tools

A list of open source Cyber Security tools

A List of Open Source Cyber Security Tools

Security monitoring, intrusion detection/prevention

• Suricata – intrusion detection system
• Snort – intrusion detection system
• Zeek – network security monitoring
• OSSEC – host-based intrusion detection system
• Wazuh – a more active fork of OSSEC
• Velociraptor – endpoint visibility and response
• OSSIM – open source SIEM, at the core of AlienVault
• SecurityOnion – security monitoring and log management
• Elastic SIEM – SIEM functionality by Elasticsearch
• Mozdef – SIEM-like layer ontop of Elasticsearch
• Sagan – log analytics and correlation
• Apache Metron – (retired) network security monitoring, evolved from Cisco OpenSOC
• Arkime – packet capture and search tool (formerly Moloch)
• PRADAS – real-time asset detection
• BloodHound – ActiveDirectory relationship detection

Threat intelligence

• MISP – threat intelligence platform
• SpiderFoot – threat intelligence aggregation
• OpenCTI – threat intelligence platform
• OpenDXL – open source tools for security intelligence sharing
• Sigma – Generic Signature Format for SIEM Systems

Incident response

• StackStorm – SOAR platform
• CimSweep – Windows incident response
• GRR – incident response and remote live forensics
• TheHive – incident response / SOAR platform
• TheHive Cortex – TheHive companion used for fast queriying
• Shuffle – open source SOAR platform
• osquery – real-time querying of endpoint data
• Kansa – PowerShell incident response

Vulnerability assessment

• OpenVAS – very popular vulnerability assessment
• ZAProxy – web vulnerability scanner by OWASP
• WebScarab – (obsolete) web vulnerability scanner by OWASP
• w3af – web vulnerability scanner
• Loki – IoC scanner
• CVE Search – set of tools for search in CVE data

Firewall

• pfsense – the most popular open source firewall
• OPNSense – hardened BSD-based firewall
• Smoothwall – Linux-based Firewall

Antivirus / endpoint protection

• ClamAV – open source antivirus angine
• Armadito AV – open source AV (retired)
• YARA – The pattern matching swiss knife for malware researchers

Email security

• Hermes Secure Email Gateway – an Ubuntu-based email gateway
• Proxmox – email gateway
• MailScanner – email security system
• SpamAssassin – anti-spam platform
• OrangeAssassin – drop-in replacement of SpamAssassin