New blue team

1. dsiem

   1 3 440 5.5 Go

   Security event correlation engine for ELK stack

   

2. InfluxDB

   www.influxdata.com featured

   InfluxDB – Built for High-Performance Time Series Workloads. InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now.

   

3. sysmon-modular

   2 15 2,775 0.9 PowerShell

   A repository of sysmon configuration modules

   

4. auditd

   3 9 1,622 4.5

   Best Practice Auditd Configuration

   

5. auditd-attack

   4 1 787 10.0

   A Linux Auditd rule set mapped to MITRE's Attack Framework

   

6. Shuffle

   5 5 1,942 9.8 Shell

   Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

   

7. TheHive

   6 25 3,566 0.0 Scala

   TheHive: a Scalable, Open Source and Free Security Incident Response Platform

   

8. AtomicPurpleTeam

   7 1 293 10.0

   Atomic Purple Team Framework and Lifecycle

   

9. SaaSHub

   www.saashub.com featured

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. caldera

    8 16 6,126 8.9 Python

    Automated Adversary Emulation Platform

    

11. RedEye

    9 7 2,531 10.0 TypeScript

    Discontinued RedEye is a visual analytic tool supporting Red & Blue Team operations

    

12. velociraptor

    10 5 3,251 9.5 Go

    Digging Deeper....

    

13. adversary_emulation_library

    11 8 1,855 9.5 C

    An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

    

    This is a great callout! To help get started, check out the adversary emulation library, https://github.com/center-for-threat-informed-defense/adversary_emulation_library. There are also micro-emulation plans, described here: https://ctid.mitre-engenuity.org/our-work/micro-emulation-plans/.

Suggest a related project