py-idstools
Malcolm
py-idstools | Malcolm | |
---|---|---|
1 | 5 | |
269 | 313 | |
- | 3.2% | |
5.6 | 9.9 | |
6 months ago | 7 days ago | |
Python | Python | |
GNU General Public License v3.0 or later | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
py-idstools
-
Regex Challenge - Field Extraction
I like this a lot. We have a in-house Snort 2 forwarder that does a similar thing with https://github.com/jasonish/py-idstools and forwards the result directly using HEC. We could use the same code base for dnstap if we wanted.
Malcolm
What are some alternatives?
snort-rules - An UNOFFICIAL Git Repository of Snort Rules(IDS rules) Releases. [UnavailableForLegalReasons - Repository access blocked]
securityonion - Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, and case management. It also includes other tools such as Playbook, osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
wazuh-ruleset - Wazuh - Ruleset
IVRE - Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, etc.
SNORT-GUI - SNORT GUI: Your very own trusted blueteam forensic companion for SNORT IDS. OPTIMIZED, SECURE AND ABSOLUTELY FREE!
core - OPNsense GUI, API and systems backend