Back to sysinternals/sysmonforlinux
Open-source alternatives to SysmonForLinux
30 open-source projects similar to sysinternals/sysmonforlinux, ranked by how many features they have in common. Compare stars, activity and what each one does to find the best SysmonForLinux alternative.
- aquasecurity/tracee
aquasecurity/tracee
4,377Voir sur GitHubTracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho
Gobpfdockerebpf - cilium/tetragon
cilium/tetragon
4,753Voir sur GitHubTetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration
C - velocidex/velociraptor
Velocidex/velociraptor
3,769Voir sur GitHubVelociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o
Godigital-forensicsendpoint-discoveryendpoint-protection
