Projects sharing features with Sigma

Podman Desktop is a graphical user interface for managing container images, pods, and volumes across multiple container engines and Kubernetes clusters. It serves as a container engine orchestrator for installing, configuring, and updating engines, as well as a deployment dashboard for connecting to Kubernetes environments and switching cluster contexts. The application is an extensible developer tool that utilizes a plugin system to allow users to add new features and orchestration capabilities through third-party modules. The tool provides a resource dashboard for local container managemen

MISP is an open-source threat intelligence sharing platform designed for collecting, storing, and distributing structured threat indicators and intelligence. At its core, it provides a distributed synchronization protocol for transferring events between instances, an attribute-based correlation engine that links matching indicators across events, and a REST API with an OpenAPI specification for programmatic access to threat data. The platform uses formal data formats for JSON, taxonomy, galaxy, and object templates to enable compatibility across tools and communities. The platform distinguish

This project is a React-based rich text editor designed for authoring and managing markdown documents through a visual interface. It functions as a modular framework that renders markdown in real-time, allowing users to create structured content without manual syntax entry. The editor is built on a plugin-based architecture that enables developers to extend functionality while maintaining minimal application bundle sizes. It provides a comprehensive command interface for programmatic content manipulation and utilizes reactive state management to ensure the visual editing surface remains synch

Volatility3 is a memory forensics framework and analysis tool used to parse volatile memory dumps. It extracts digital artifacts and reconstructs the runtime state of a system to recover process information, network artifacts, and other forensic evidence. The system functions as a plugin-based forensic engine and an operating system symbol resolver. It maps raw memory addresses to known system structures using symbol tables and translation layers, and provides an extensible architecture for creating custom scanners and renderers. The framework includes a command-line memory explorer for real

rbenv is a Ruby version manager and shell shim environment manager. It allows for the installation of multiple Ruby versions on a single machine and coordinates the selection of the active version based on the current directory or shell session. The tool functions as an extensible command line framework that intercepts executable calls using shell shims. These shims route requests to the selected language version, ensuring environment isolation by storing binaries in independent directories. The system includes capabilities for language runtime administration, including the ability to downlo

Sigma File Manager is a cross-platform desktop application for browsing, organizing, and searching local and network files through a modern graphical interface. It functions as an integrated file previewer, network storage client, and local network file share utility. The application is built on an extensible architecture that allows users to add custom commands, pages, and settings through a plugin system and marketplace. It distinguishes itself with the ability to stream local files and folders to other devices over a local network using browser access, QR codes, and FTP. Core capabilities

OSINT-SPY is an open-source reconnaissance framework designed for gathering intelligence on digital infrastructure and tracking financial activity across distributed ledgers. It functions as a centralized orchestrator that queries multiple third-party services and public databases to aggregate security data points into a unified format. The system utilizes a modular, plugin-based architecture that allows for independent data gathering tasks, ranging from domain and IP address reconnaissance to the analysis of remote files for malicious signatures. It supports specialized investigations into c

OpenSearch is a distributed search and analytics engine designed for indexing, searching, and analyzing massive volumes of structured and unstructured data in real time. It functions as a comprehensive platform that integrates enterprise-grade search capabilities, a vector database for high-dimensional similarity lookups, and a unified observability suite for monitoring logs, metrics, and traces across complex distributed environments. The platform distinguishes itself through its support for agentic workflow automation, allowing users to orchestrate multi-agent tasks and integrate foundation

This repository contains example YARA-L rules and dashboards for use within Google Security Operations (SecOps)

Zellij is a terminal multiplexer and workspace manager designed to organize command-line sessions into persistent, reconfigurable layouts. It functions as a terminal plugin framework, allowing users to extend their environment with modular, event-driven components that interact with the host through a structured message-passing protocol. The project distinguishes itself through a layout-engine-based architecture that decouples visual pane arrangements from process execution, enabling automated and repeatable terminal workflows. It includes integrated support for web-based remote access, facil

IntelOwl is a threat intelligence platform and security orchestration engine designed to aggregate, analyze, and enrich security observables. It functions as a security incident investigation tool and a threat intelligence aggregator, collecting data on files, domains, and IP addresses from diverse internal and external sources. The system differentiates itself through playbook-based workflow automation, allowing users to define reusable sequences of analysis tasks that trigger subsequent jobs based on prior outputs. It unifies disparate security data into a common schema and utilizes protoco

This project is a static analysis runner designed to identify bugs, performance bottlenecks, and stylistic inconsistencies within Go codebases. It functions as a comprehensive quality assurance suite that executes multiple analysis tools concurrently to provide a unified diagnostic report. By parsing source code into a structured representation, the tool enforces coding standards, validates import structures, and ensures consistent formatting across entire projects. The tool distinguishes itself through its ability to automate the remediation of identified issues, applying programmatic fixes

Searchkit is a search UI framework designed for building search interfaces with React and Vue that connect to Elasticsearch and OpenSearch backends. It provides a search query translation layer to convert frontend search states into engine-specific query languages and a result rendering engine to display hits, facet menus, and pagination. The framework includes a semantic search interface that enables vector-based nearest neighbor searches and natural language processing. It differentiates itself through an adapter-based translation system and a component-based UI mapping that connects search

ClickHouse is a high-performance, columnar analytical database designed for real-time query execution and large-scale data aggregation. It functions as a distributed data warehouse capable of processing petabytes of information, while also providing an embedded engine that integrates directly into applications for native query capabilities without external dependencies. The system is built to handle high-throughput ingestion and complex analytical workloads, delivering millisecond-level latency for interactive dashboards and operational monitoring. The platform distinguishes itself through ad

CrowdSec is a collaborative, distributed security engine designed for threat detection and infrastructure protection. It functions as an intrusion detection system that parses logs and network traffic to identify malicious patterns, utilizing a bucket-based threshold detection model to aggregate events and trigger alerts. The platform is built on a modular architecture that includes a centralized local API server for managing security signals and a relational database for persistent storage of remediation decisions. What distinguishes the project is its decoupled enforcement model, which offl

FlatBuffers is a cross-platform serialization library designed for performance-critical applications that require efficient, zero-copy data access. By organizing data in a structured binary format, it allows applications to read and write complex data structures directly from memory-mapped buffers without the need for intermediate parsing or temporary object allocation. The project distinguishes itself through a schema-driven approach that balances high-performance access with long-term data evolution. It utilizes a unique memory layout featuring relative offsets and inline fixed-size structu

hello-sql is a collection of educational resources and practical guides designed for mastering relational database design, SQL query writing, and schema mapping. It provides a set of lessons and exercises for practicing the creation and manipulation of data within relational databases. The project includes a database schema workbook for designing tables and mapping relationships, alongside a dedicated SQL query guide for writing selection, filtering, and aggregation statements. These resources are delivered through a relational database tutorial and a broader SQL learning resource. The mater

This project is a centralized API specification registry and governance framework. It serves as a source of truth for structured API schemas, gRPC definitions, and data models used to maintain consistency across a large ecosystem of services. The system functions as a multi-language client generator, transforming standardized interface definitions into executable source code and language-specific libraries. This process ensures that client libraries and technical documentation remain synchronized by deriving them directly from the original interface definitions. The project also covers the m

Fury is a multi-language binary serialization framework designed for encoding domain objects and complex graphs to facilitate cross-language data exchange. It includes an interface definition language compiler that translates schema definitions into idiomatic native types and serialization boilerplate across multiple languages. The project distinguishes itself through a zero-copy binary reader that allows specific fields to be accessed without deserializing the entire object, as well as an object graph serializer that preserves circular references and referential integrity. It also features a

Small is a cross-platform plugin framework and modularization tool designed to break monolithic mobile applications into independent components. It provides a modular mobile architecture that allows developers to split applications into decoupled plugins to reduce system complexity and memory usage across multiple operating systems. The framework includes a dynamic module loader for on-demand feature loading to improve startup times and a dependency injection service registry that connects feature modules to a central core for service discovery. The system provides a platform abstraction lay

DataX is a distributed data integration framework and plugin-based ETL tool designed for synchronizing large datasets between heterogeneous sources and destinations. It functions as a JDBC data migration engine and offline synchronization tool, enabling the movement of data between relational databases, NoSQL stores, and object storage. The system utilizes a plugin-based connector architecture that decouples reader and writer logic, allowing it to map and transform data types across different storage engines using a standardized internal representation. This design supports heterogeneous data

MagicMirror is an open source framework for creating personalized information dashboards, specifically designed for use as a modular smart mirror platform and a plugin-based dashboard framework. It functions as a system for aggregating data feeds and modular components to create a centralized information hub. The platform utilizes a module-based plugin architecture that allows for the development and integration of custom third-party plugins through a standardized interface. This extensibility enables the creation of personalized displays and custom data widgets. The system supports a headle

Vorpal is a Node.js interactive CLI framework and terminal user interface library used to build extensible command-line shells. It functions as an interactive command-line parser that converts string input into executable functions, managing the lifecycle of terminal sessions and command routing. The framework is distinguished by a plugin-based extension architecture that allows external modules to register new commands, shared behaviors, and complete command suites into the core environment. It supports the creation of custom shell environments with specialized namespaces and a system for pe

Hapi is a configuration-driven web framework for building secure and scalable HTTP servers and APIs on the Node.js runtime. It functions as a REST API development framework and an enterprise server implementation focused on stability, security, and comprehensive input validation. The framework is built around a plugin-based architecture, allowing core functionality and custom logic to be organized into modular, registerable plugins. It serves as an HTTP request lifecycle manager, enabling the interception and modification of requests through pre-handlers and extensions before they reach the f

WordPress is an open-source content management system and PHP-based application framework designed for building and maintaining websites. It functions as a visual, block-based website builder that allows users to construct layouts and manage digital content without manual code entry. The platform supports a wide range of operational needs, from managing individual sites to administering complex multi-site networks from a single installation. The system is distinguished by its highly extensible, plugin-driven modular architecture, which allows for the integration of third-party modules to add

This project is a modular, terminal-based dashboard framework designed to aggregate and display real-time information within a grid-aligned interface. It functions as a centralized monitoring tool that translates data from local system resources, infrastructure services, and external web APIs into a unified, text-based display. The dashboard is distinguished by its plugin-based architecture, which allows users to encapsulate distinct data sources and display logic into isolated, independently managed modules. Users define their workspace through declarative configuration files or an interacti

PowerToys is a collection of background-resident system utilities designed to extend native operating system functionality and streamline desktop workflows. It operates as a modular toolkit, utilizing a central plugin-based host architecture that allows users to dynamically enable or disable specific features for system configuration and automation. By leveraging native system hooking, the suite intercepts global input and window events to provide advanced control over the computing environment. The project distinguishes itself through its focus on cross-device input orchestration and spatial