weslambert

velociraptor-docker. Docker image for Velocidex Velociraptor

DinoSOARLab. Security Onion + Automation + Response Lab including n8n and Velociraptor

velocistack. JavaScript

securityonion-velociraptor. Run Velociraptor on Security Onion

securityonion-misp. Shell

securityonion-strelka. YARA

misp2elastalert. Convert MISP events to Elastalert rules

securityonion-sigma.

velociraptor-misp. Artifacts for integrating MISP with Velociraptor

securityonion-sublime. Ingest Sublime email alerts into Security Onion

securityonion-limacharlie. Send logs from LimaCharlie to Security Onion

securityonion-otx. Shell

securityonion-rita. Shell

securityonion-n8n. Install n8n on Security Onion to assist with automating context gathering and response

SOCtopus. Python

misp2elastic. Dockerized method to pull threat intel from MISP and use it to enrich Elasticsearch data via Logstash and Memcached

LinuxCatScale. Incident Response collection and processing scripts with automated reporting scripts

BlueCloud. Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.

otx2elastic. Dockerized method to pull OTX thread feed data to enrich data in Elasticsearch

Cortex-Analyzers. Cortex Analyzers Repository

MISP. MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)

securityonion-xforce. Python

sguil-pivots. Tcl

securityonion-docker-airgap. Shell

securityonion-docker-registry. Shell

e2. Python

timesketch. Collaborative forensic timeline analysis

securityonion-airgap. Shell

python-apps. Apps to be used for Shuffle automation

fsf. File Scanning Framework

Audit. Collection of Audit and Compliance related VQL artifacts

velociraptor-ecs. ECS Mappings for Velociraptor Artifacts

jamfprotect. A repository for open-source resources created for use with or alongside Jamf Protect.

APTSimulator. A toolset to make a system look as if it was the victim of an APT attack

hive2elastic. Correlate TheHive cases with events in Elasticsearch utilizing Logstash and Memcached

securityonion-grr. Shell

velociraptor. Digging Deeper....

bro-otx. Integrate Bro with Alienvault OTX

CyberChef-server. A server providing RESTful access to CyberChef

fir-powershell. Fast Incident Response API Client: PowerShell Example

Tools. Distribute third party tools for use with Velociraptor

securityonion-misp-docker.

PyMISP. Python library using the MISP Rest API

presentations.

securityonion-elastalert-rules.

securityonion-cloud. Python

ChopChopGo. Rapidly Search and Hunt through Linux Forensics Artifacts

ja3. JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

securityonion-docker-wazuh. Tcl