Outils blue team

Live PowerShell disk forensics.

Multi-cloud security posture.

Endgame's ATT&CK simulation framework.

Self-hosted open-source WAF.

Python packet manipulation library.

Multi-cloud security auditing.

Open SOC distribution.

Remote SSH for the edge.

Open-source SOAR.

Vendor-agnostic detection rules.

Local-first threat hunting over logs you already have

Cross-platform network traffic monitor with threat detection

Open-source IPS, next generation.

CVE intelligence and exploit lookup CLI.

Build vulnerable instrumented labs.

Cloud adversary emulation.

High-performance IDS / IPS.

Sigma-based threat hunting and timeline generator for cloud logs.

Battle-tested Sysmon configuration.

Microsoft's Sysmon, on Linux.

All-in-one honeypot platform.

Wireshark on the command line.

Zero-trust access for SSH, K8s and more.

eBPF-based runtime security.