Open-source alternatives to Openvmi

Deskflow is a cross-platform input multiplexer that enables the use of a single mouse and keyboard to control multiple computers. By routing input signals over a local network, it functions as a software-based replacement for physical hardware switches, allowing users to manage several systems as a unified workstation environment. The software operates using a client-server topology where a central controller manages input focus and connection state across remote nodes. It normalizes disparate operating system input APIs into a unified format, enabling consistent cursor movement and periphera

HertzBeat is a real-time observability platform that provides agentless monitoring for servers, databases, and networks. It functions as an infrastructure alerting manager, an OpenTelemetry Protocol log aggregator, and a public status page generator. The platform integrates an analysis engine that uses large language models to process monitoring data and generate system insights. It utilizes a cloud-edge collaborative architecture and distributed collector clustering to scale data gathering across large-scale networks. The system covers a broad range of observability capabilities, including

Netdata is a real-time infrastructure monitoring tool and multi-node observability platform. It functions as a high-resolution monitoring agent, log and metric aggregator, and time-series database designed to provide full-stack visibility into server health. The system is distinguished by its per-second metric sampling and zero-configuration auto-discovery, which allows for immediate infrastructure tracking upon installation. It utilizes edge-based machine learning and unsupervised models to detect system anomalies and abnormal metric patterns locally on each node. For distributed environment

Ganglia Monitoring core

GNU Radio is an open-source software-defined radio framework that provides a digital signal processing toolkit for building wireless communication systems. At its core, it uses a block-based flow graph architecture where pre-built signal processing blocks are connected into directed graphs to define and execute custom radio signal processing pipelines. The system operates as a flow graph signal processor that enables low-latency streaming radio signal processing, supporting both real-time operation and wireless communication simulation entirely in software. The framework distinguishes itself

Gqrx is a software defined radio application used to capture and demodulate radio signals across various frequencies to produce audio and visual data. It translates raw radio waves into audible sound using standard modes including AM, FM, SSB, and CW. The project provides tools for radio signal analysis through real-time frequency plots and waterfall displays. It enables the capture of raw baseband data and received audio for offline playback and technical analysis. The software includes capabilities for tuning radio frequencies, filtering signal noise via band-pass filters and gain control,

Hook system calls on Windows by using Kaspersky's hypervisor

Motion is network camera surveillance software and a video motion detection system. It ingests video signals from IP cameras and hardware capture cards to provide real-time security monitoring, automated movement detection, and secure web-based streaming. The system functions as a video activity logger, recording event history and metadata into databases for long-term tracking. It can automatically trigger external scripts or software tools in response to detected motion and save video clips or still images to create a record of events. The software supports concurrent processing of multiple

Nagios Core

Opserver is a cross-platform monitoring server and infrastructure dashboard designed for tracking system health, performance metrics, and backend service availability. It functions as an external metric aggregator and enterprise health oversight tool, centralizing data from third-party monitoring sources into a single view. The system integrates with incident response services like PagerDuty to map user identities and manage notification workflows. It also connects with external directory and identity providers to handle user authentication and permission assignments. The platform covers sev

ModSecurity is an open-source web application firewall and security engine. It functions as an HTTP traffic inspector and intrusion detection system that filters incoming web requests and responses against a set of security rules to block threats and prevent attacks on web servers. The project provides a modular framework for implementing restrictive security policies and custom filtering logic. It identifies and blocks common injection attacks, such as cross-site scripting and SQL injection, while hardening web applications to reduce their overall attack surface. Its broader capabilities in

FastNetMon is a network traffic analyzer and DDoS detection system designed to identify and mitigate distributed denial of service attacks. It functions as a BGP blackhole controller and mitigation orchestrator, monitoring network traffic in real time to detect hosts that exceed predefined thresholds for packets, bytes, or flows per second. The system distinguishes itself through automated mitigation capabilities, using BGP-based route announcements to block malicious IP addresses across network infrastructure. It supports hardware-specific interventions for vendors such as Juniper and MikroT

Snort++

lnav is a terminal-based log viewer and analyzer designed for aggregating, filtering, and analyzing multiple log files in a single chronological view. It functions as a console application that can replace the system pager, providing syntax highlighting and document navigation for system or application logs. The project distinguishes itself by mapping unstructured log data to virtual SQLite tables, enabling the use of SQL and PRQL for structured data analysis, aggregations, and relational queries. It further differentiates its capability set through native integration for retrieving and taili

Wazuh is an integrated security platform that combines endpoint detection and response, security information and event management, and cloud workload protection. It functions as a centralized system for collecting telemetry, aggregating logs, and correlating events across distributed infrastructure to maintain security and integrity. The platform distinguishes itself through its active response orchestration, which allows for the automated execution of scripts on remote endpoints to neutralize threats in real time. It provides deep visibility into system activity through file integrity monito

Zeek is a network analysis framework and security monitoring tool that transforms raw network packets into high-level semantic logs. It functions as an application protocol analyzer and network intrusion detection system designed to extract meaning from network traffic and monitor for malicious activity. The system focuses on archiving network activity and maintaining historical records of application-layer state for forensic investigation and auditing. It utilizes a combination of modular protocol analyzers and customizable detection policies to perform deep semantic analysis of numerous app

TrafficMonitor is a system performance monitor that provides a floating desktop window and taskbar overlay to track real-time CPU, memory, and network speed metrics. It functions as a customizable system overlay and hardware resource tracker, displaying live statistics and user-defined data through transparent desktop widgets. The project uses a plugin-based system and dynamic-link libraries to extend data sources and add new hardware tracking capabilities. It includes a theme engine that reads external configuration files to apply custom skins, fonts, and background colors to the interface.