Top 7 Python Siem Projects

sigma

41 7,598 9.8 Python

Main Sigma Rule Repository

Project mention: Sigma rules in real life | /r/cybersecurity | 2023-10-14

Sigma rules https://github.com/SigmaHQ/sigma its value, I get it. Here’s a post https://www.linkedin.com/posts/nasreddinebencherchali_detection-blueteam-sigma-activity-7104868070069817344-mn91?utm_source=share&utm_medium=member_desktop detailing that 31 Sigma rules from the Sigma repository are triggering on different stages of the attack as described here https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/

RedELK

5 2,282 7.1 Python

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

Project mention: What project ideas are there for a cybersecurity homelab? | /r/AskNetsec | 2023-06-04

Play with RedELK for learning ELK and monitoring blue team activities - https://github.com/outflanknl/RedELK

WorkOS

workos.com sponsored

The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
Digital-Forensics-Guide

6 1,335 6.4 Python

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Project mention: Most used DFIR tools | /r/cybersecurity | 2023-12-10

If you're looking to learn on your own, try mikeroyal's digital forensics guide on Github. There's a lot of recommended resources there that'll speed you up. https://github.com/mikeroyal/Digital-Forensics-Guide

PurpleCloud

1 473 5.5 Python

A little tool to play with Azure Identity - Azure Active Directory lab creation tool
OpenSIEM-Logstash-Parsing

2 174 8.7 Python

SIEM Logstash parsing for more than hundred technologies
impulse-xdr

3 96 7.3 Python

Fully automated host & network intrusion detection platform. Detects malware from behavioural patterns rather than signatures and enables deeper visibility than legacy tools.

Project mention: New host intrusion detection system Impulse | news.ycombinator.com | 2024-04-01

MISP-QRadar-Integration

2 36 0.0 Python

The Project can be used to integrate QRadar with MISP Threat Sharing Platform
InfluxDB

www.influxdata.com sponsored

Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020).