security-operations

There are 6 repositories under security-operations topic.

satan1a / TheRoadOfSO
学习安全运营的记录 | The knowledge base of security operation
security-operations cybersecurity security-analysis threat-analysis security-operation soc wiki knowledge-base
Language:HTML 857
reconmap / reconmap
Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance through execution and reporting. With built-in command automation, output parsing, and AI‑assisted summaries, it delivers faster, more structured, and high‑quality security assessments.
ai-security ai-tools bug-bounty collaboration-platform command-automation devsecops hacktoberfest infosec mssp-tools penetration-testing pentesting reporting-tools security security-automation security-operations security-platform security-workflow vulnerability vulnerability-management
Language:HTML 799
GoogleCloudPlatform / security-analytics
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
security gcp google-cloud bigquery chronicle cloud-security-command-center audit-logs log-analytics logging network-analysis network-logs security-operations threat-detection
Language:Python 346
Kirtar22 / Litmus_Test
Detecting ATT&CK techniques & tactics for Linux
mitre-attack threathunting linux-hunting incident-response security-operations defensive-security blue-team red-team
Language:Roff 258
NVISOsecurity / ee-outliers
Open-source framework to detect outliers in Elasticsearch events
outliers netsec threat-hunting statistics security-monitoring anomaly-detection outlier-detection siem cirt security-operations ee-outliers ml machine-learning statistical-analysis
Language:Python 209
ControlCompass / ControlCompass.github.io
Pointing cybersecurity teams to thousands of detection rules and offensive security tests aligned with common attacker techniques
security intelligence cybersecurity threat-intelligence threat-hunting red-teaming red-team detection detection-engineering mitre-attack siem security-tools security-operations soc infosec information-security
Language:JavaScript 136
gbrigandi / mcp-server-wazuh
MCP Server for Wazuh SIEM
llm mcp mcp-server model-context-protocol-servers security-operations siem wazuh wazuh-integration model-context-pro
Language:Rust 136
gerardokaztro / cybersecurity-entry-level
Curso para aprender Ciberseguridad desde cero, en español y 100% gratis. Abarca 5 dominios fundamentales que necesitas conocer para poder dar tus primeros pasos en este apasionante mundo.
access-control backup ciberseguridad cybersecurity disaster-recovery fundamentals incident-response network-security security-operations seguridad-de-la-informacion seguridad-informatica tutorial
114
nbyiansec / sskit
安全运维工具箱是一款面向安全运维场景的集成化利器，融合了资产管理、资产测绘、漏洞检测、配置核查、弱口令检测、批量化运维、漏洞跟踪、报告生成以及日志审计等核心功能模块。
asset-management asset-mapping configuration-verification device-inspection host-hardening nuclei security security-operations security-tools vulnerability-detection weak-password-detection
110
NP558565 / ISC2-CC-Cybersecurity-Study-Material
My learning, tutorials on Cybersecurity
access-control business-continuity incident-response network-security security-operations security-principles
Language:HTML 90
mcp-panther
panther-labs / mcp-panther
Write detections, investigate alerts, and query logs from your favorite AI agents
ai cybersecurity mcp-server security-operations
Language:Python 32
SHolzhauer / elastic-tip
Elastic TIP is a python tool which automates the process of aggregating Threat Intelligence and ingesting the intelligence into a common format into Elasticsearch with the main goal of being used by the Security solution.
elasticsearch siem security security-operations threat-intelligence ioc
Language:Python 28
alexfrancow / iSOC
:bar_chart: Deploy an "illegal" SOC to manage vulnerabilities on your city servers in minutes.
blue-team bugbounty bugbounty-tool cybersecurity docker docker-compose elasticsearch elk kibana mongodb openvas python3 red-team security-operations siem vulnerability-detection w3af zabbix
Language:Jupyter Notebook 19
H3llKa1ser / SOC-Assistant-Guide
A Security Operations playbook to assist blue teamers from day-to-day tasks to Digital Forensics and Incident Response (DFIR) activities.
cyber-threat-intelligence cybersecurity detection-engineering digital-forensics-incident-response security-operations threat-hunting
19
dnsbeat
0xThiebaut / dnsbeat
An Elasticsearch Beat to monitor DNS zones through customizable zone transfers.
elasticsearch dns monitoring zone-transfers detection security-operations
Language:Go 13
MrM8BRH / Defensive-Security-Hub
A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts.
blueteam cheatsheets cyber-threat-intelligence detection-engineering dfir email-security incident-response log-analysis malware-analysis security-operations soc-analyst threat-hunting hunting-techniques threat-intel-feeds blueteam-tools ioc security-operations-center soc mrm8brh
9
austinsonger / Interviewing
Interviewing Help for Information Security Jobs (With Answers)
compliance cyber-security cybersecurity information-security interviewing network-security risk risk-assessment security-operations threat-management governance-risk-compliance
6
gapilongo / SOC
Intelligent SOC automation framework powered by LangGraph multi-agent workflows for alert triage, correlation, and incident response
ai-agents alert-triage cybersecurity incident-response langchain langgraph multi-agent-system python security-automation security-operations security-orchestration soc threat-detection threat-intelligence workflow-automation
Language:Python 5
Balzu / Security-Events-Explorer
A user-friendly and powerful tool to analyze Windows Security Events
active-directory active-directory-exploitation active-directory-security blueteam blueteaming event-viewer log-intelligence soc windows windows-security active-directory-authentication ceh cissp security-analysis security-operations security-tools white-hat windows-local-exploit windows-logon
Language:JavaScript 4
aymenmarjan / MISP-Wazuh-Integration
A comprehensive integration solution connecting MISP threat intelligence with Wazuh security monitoring for real-time threat detection. This project provides step-by-step instructions for deploying, configuring, and integrating MISP and Wazuh with Sysmon to automatically detect indicators of compromise (IoCs) in your environment.
blue-team cybersecurity devsecops incident-response ioc-detection misp security-automation security-integration security-monitoring security-operations security-tools sysmon threat-detection threat-intelligence wazuh
3
darkquasar / purplerepo
🛡️⚔️ Curated GitHub repos for Defensive & Offensive Cyber Tradecraft
automation cyber-tools cyberops detection-engineering dfir-automation security-operations threat-hunting threat-intelligence cloudflare-workers
Language:TypeScript 3
databricks-industry-solutions / incident-investigation-using-graphistry
Visual analytics using Databricks & Graphistry for cybersecurity investigations
cybersecurity graph investigations security-operations visualization
Language:Python 3
Chinuaoku / ISC2-Certified-in-Cybersecurity
This is a cybersecurity certification that proves that an individual have the fundamental knowledge, skills and ability for an entry-level or junior-level cybersecurity role. It is ANAB accredited, ISO/IEC STANDARD 17024.
disaster-recovery network-security security-operations access-control-concepts business-continutity incidence-response-concepts security-principles
2
CTDR
Raqeeb27 / CTDR
Cyber Threat Detection and Response: Integration of Sysmon, YARA, Sliver C2, and LimaCharlie EDR to simulate and analyze ransomware/memory dump threats
blue-team cyber-security-lab cybersecurity edr incident-response red-team soc threat-detection cyber-defense home-lab limacharlie security-operations simulated-attacks sysmon virtualization yara sliver-c2
2
austinsonger / Intel-Hash
Takes a Onion URL and Hashes it and compares it against blacklisted hashed onion URLS
script security security-tools security-operations
Language:Python 1
haroutp / azure-security-architecture
Enterprise Azure security architecture with multi-domain implementation covering identity, network, compute, and security operations
az-500 azure-architecture azure-security azure-sentinel cloud-security compliance cybersecurity enterprise-security identity-management key-vault network-security powershell security-operations siem threat-detection
Language:PowerShell 1
penxpkj / Defensive-Security-Hub
# Defensive Security Hub A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts. This repository aims to support your security efforts and enhance your skills. 🌐🔒
blueteam blueteam-tools cheatsheets cyber-threat-intelligence detection-engineering dfir email-security hunting-techniques incident-response ioc malware-analysis security-operations security-operations-center soc soc-analyst threat-hunting threat-intel-feeds
1
SOC-101 / SOC-Introduction
Introduction to SOC and related terminologies.
soc hardening incident-response incident-response-tooling siem soar blue-teams cyber-threat-intelligence security-operations
1
AWS-CSS-Portfolio / logging-monitoring
Centralized AWS security monitoring lab using CloudTrail, CloudWatch, and Athena to detect root account usage and unauthorized API calls. Includes saved queries, dashboards and threat-hunting examples.
athena aws centralized-logging cloudtrail cloudwatch logging-and-monitoring security-analytics security-operations sns-alerts threat-hunting aws-security-specialty
dfirvault / Splunk-Case-Manager
Splunk case manager
dfir dfirvault splunk case-management incident-management security-operations soc
Language:Python
fpeakman / Useful-Cyber-Resources
A list of free or open source tools or resources that have proven useful over the years.
active-directory azure blocklist cheatsheets cyber-threat-intelligence cybersecurity cybersecurity-engineering cybersecurity-tools detection-engineering incident-response opensource security-engineering security-hardening security-operations security-operations-center security-tools
josamontiel / free-sec-tools
A list of free cybersecurity tools with links. Creating this for my own reference. These tools are separated by category that would typically be seen in a SOC.
cybersecurity security-operations security-operations-center soc-analyst
LyticOnaope / Phishing-Email-Analysis
Executive phishing email analysis for VitalCare Health Solutions – includes header inspection, BEC indicators, SPF/DKIM/DMARC checks, malicious attachment & URL analysis, and a stakeholder-ready executive report with findings, impact, and recommendations.
business-email-compromise cyber-threat-analysis cybersecurity email-security incident-response ioc-detection malware-analysis phishing-analysis security-operations soc-analyst threat-hunting threat-intelligence
Matt-C-G / endpoint-labs
artifacts asr automation bitlocker defender endpoint-security evidence powershell security-operations endpoint portfolio soc
Language:PowerShell
Matt-C-G / sentinel-labs
automation incident-response kql sc-200 security-operations sentinel soc threat-hunting workbook
YASHWANTgs / SOC-Ticketing-workflow-Jira-ServiceNow
Simulated SOC ticketing workflow using Jira and serviceNow for phishing, Malware, And login alert investigations.
incident-response jira login-alert security-operations service-now ticketing-system

security-operations

satan1a / TheRoadOfSO

reconmap / reconmap

GoogleCloudPlatform / security-analytics

Kirtar22 / Litmus_Test

NVISOsecurity / ee-outliers

ControlCompass / ControlCompass.github.io

gbrigandi / mcp-server-wazuh

gerardokaztro / cybersecurity-entry-level

nbyiansec / sskit

NP558565 / ISC2-CC-Cybersecurity-Study-Material

panther-labs / mcp-panther

SHolzhauer / elastic-tip

alexfrancow / iSOC

H3llKa1ser / SOC-Assistant-Guide

0xThiebaut / dnsbeat

MrM8BRH / Defensive-Security-Hub

austinsonger / Interviewing

gapilongo / SOC

Balzu / Security-Events-Explorer

aymenmarjan / MISP-Wazuh-Integration

darkquasar / purplerepo

databricks-industry-solutions / incident-investigation-using-graphistry

Chinuaoku / ISC2-Certified-in-Cybersecurity

Raqeeb27 / CTDR

austinsonger / Intel-Hash

haroutp / azure-security-architecture

penxpkj / Defensive-Security-Hub

SOC-101 / SOC-Introduction

AWS-CSS-Portfolio / logging-monitoring

dfirvault / Splunk-Case-Manager

fpeakman / Useful-Cyber-Resources

josamontiel / free-sec-tools

LyticOnaope / Phishing-Email-Analysis

Matt-C-G / endpoint-labs

Matt-C-G / sentinel-labs

YASHWANTgs / SOC-Ticketing-workflow-Jira-ServiceNow