DetectIQ is an AI-powered security rule management platform that helps create, analyze, and optimize detection rules across multiple security platforms. It can be used with the provided UI, or just with Python scripts using the self contained detectiq/core module. See examples in the examples…
Las características principales de attackiq/detectiq son: Security Lab Environments.
Las alternativas de código abierto para attackiq/detectiq incluyen: zhuifengshaonianhanlu/pikachu — Pikachu is a web security training platform and vulnerable web application sandbox. It provides a containerized lab… lionsec/katoolin — Katoolin is a Debian software repository manager and security toolset automator. It functions as a script to automate… aquasecurity/tracee — Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events… cea-sec/openwec — OpenWEC is a free and open source (GPLv3) implementation of a Windows Event Collector server running on GNU/Linux and… certsocietegenerale/fir — Fast Incident Response. azr43lkn1ght/dfir-labs — DFIR LABS is a compilation of challenges that aims to provide practice in simple to advanced concepts in the following…
Pikachu is a web security training platform and vulnerable web application sandbox. It provides a containerized lab environment designed for practicing penetration testing and identifying common security flaws. The project serves as an OWASP Top 10 practice lab, offering a simulation suite for critical risks. It includes specific scenarios for practicing the exploitation of SQL injection, cross-site scripting, remote code execution, and broken access control. The environment covers a broad range of security testing simulations, including directory traversal, server-side request forgery, unsa
Katoolin is a Debian software repository manager and security toolset automator. It functions as a script to automate the addition of repositories and the installation of security tools from Kali Linux onto other Debian-based systems. The project focuses on automating the deployment of penetration testing and forensics software. It provides a method for managing third-party software sources and provisioning security labs with tools for network and system testing without requiring a full operating system installation. The tool includes an interactive command line interface for navigating tool
Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho
DFIR LABS is a compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.