Outils pour blue team

Open-source EDR for Windows.

Open-source XDR and SIEM.

Network protocol analyzer.

Pattern matching for malware research.

Community YARA rule repository.

Open-source threat-intel platform.

Network analysis framework.

Catch malicious AUR packages before makepkg builds them.

Multi-layer bot detection for browser and server.

Identify executable capabilities.

Detect typosquats and phishing domains.

Audit Keycloak configuration for security misconfigurations

Detect malicious capabilities in code, binaries and containers.

SQL-powered endpoint visibility.

Lockfile scanner for known-compromised dependencies.

Lightweight firewall that drives the Windows Filtering Platform directly.

SSH server and client config auditor.

Easy SSH honeypot.

Transparent SSH bastion.

Modular Sysmon configuration repo.

Command-line packet capture.

Test TLS/SSL on any port.

Trace any process, port, container or file back to what started it.