Top 6 Python intrusion-detection Projects

Fail2Ban

49 10,366 8.8 Python

Daemon to ban hosts that cause multiple authentication errors

Project mention: Looking for a way to remote in to K's of raspberry pi's... | /r/sysadmin | 2023-12-10

now some things you need to think about: - cloud init - this will need to be secure so lock it down hard anything not needed an alternative OS to look at if you have the ability's is https://www.alpinelinux.org/ also as these devices are not that powerfull every extra agent / abstaction layer you add impacts performance need to look at low over head security https://www.crowdsec.net/ and https://github.com/fail2ban/fail2ban (if you call fail2ban security) - using certificates to authenticate ssh login
maltrail

5 5,731 10.0 Python

Malicious traffic detection system

Project mention: Maltrail: Malicious traffic detection system | /r/selfhosted | 2023-07-05

I just wanted to tell you about Maltrail (https://github.com/stamparm/maltrail/).
InfluxDB

www.influxdata.com
sponsored

Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
Digital-Forensics-Guide

6 1,331 6.4 Python

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Project mention: Most used DFIR tools | /r/cybersecurity | 2023-12-10

If you're looking to learn on your own, try mikeroyal's digital forensics guide on Github. There's a lot of recommended resources there that'll speed you up. https://github.com/mikeroyal/Digital-Forensics-Guide
picosnitch

33 572 8.6 Python

Monitor Network Traffic Per Executable, Beautifully Visualized

Project mention: Linux runtime security agent powered by eBPF | news.ycombinator.com | 2023-10-19

Yep, and from my experience too (made a tool that monitors network traffic with eBPF [1]) in addition to those issues there is also a sizable latency hit.
[1] https://github.com/elesiuta/picosnitch
py-idstools

1 268 5.6 Python

idstools: Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool)

Project mention: Regex Challenge - Field Extraction | /r/Splunk | 2023-06-12

I like this a lot. We have a in-house Snort 2 forwarder that does a similar thing with https://github.com/jasonish/py-idstools and forwards the result directly using HEC. We could use the same code base for dnstap if we wanted.
pyHIDS

3 49 8.6 Python

A HIDS (host-based intrusion detection system) for verifying the integrity of a system.

Project mention: PyHIDS 0.9.0: Bloom filter export feature | news.ycombinator.com | 2023-10-10

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020). The latest post mention was on 2023-12-10.