Tools for blue team

eBPF-based runtime security.

Open-source SIRP for incident response.

Open-source cloud-native protection platform.

Container and IaC vulnerability scanner.

Unix-like artifact collector.

Endpoint visibility and DFIR.

Agent-less Linux vulnerability scanner.

Open-source EDR for Windows.

Open-source XDR and SIEM.

Network protocol analyzer.

Pattern matching for malware research.

Community YARA rule repository.

Open-source threat-intel platform.

Network analysis framework.

Identify executable capabilities.

Detect typosquats and phishing domains.

SQL-powered endpoint visibility.

SSH server and client config auditor.

Easy SSH honeypot.

Transparent SSH bastion.

Modular Sysmon configuration repo.

Command-line packet capture.

Test TLS/SSL on any port.