Havuz

AiSOC, güvenlik telemetrisini birleştirip tehditleri tespit eden ve AI agent ile incelerken karar adımlarını kayda alan, self-hosted bir SOC platformudur.

Neden yükseliyor · 149 günlük yaşına rağmen 2.370 yıldız ve son 28 günde 247 commit dikkat çekiyor; self-hosted kurulum, yerel modelle API key gerektirmeyen başlangıç ve çalışır demo akışı projeyi denemeyi kolaylaştırıyor. Commit sayısı yüksek olsa da katkı 3 farklı yazarla sınırlı; yükselişin nedenini doğrudan doğrulayacak benimsenme verisi yok.

Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8

Vigil SOC: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.

Wazuh MCP Server: AI-Driven SOC Automation

Open-source security for AI coding agents: record, detect and block at the tool boundary, with a verifiable audit trail in the SIEM you alre

Open-source, self-hosted security pipeline for IT, AI and OT. Logs in. Evidence out.: OCSF normalization, 46 detection rules (MITRE/ATLAS/IC

The enterprise gateway for autonomous agents. Identity management, per-channel isolation, credential vault, per-session tamper-evident audit

Lightweight open-core SIEM in Rust — S3-compatible for logs, Postgres for state.

Agentless SOC & GRC — SIEM, FIM, MITRE ATT&CK, compliance over SSH. Nothing installed on servers. Web · Windows · Linux · Docker.

Operate Splunk Enterprise and Splunk SOAR as code with a safety-first CLI and MCP server for humans and AI agents.

Open-source config scanner for AI coding agents: scores the permissions, hooks, sandbox and MCP settings of Claude Code, Codex, Cursor and G

Local-LLM alert triage for self-hosted SOCs.

Multi-EDR & SIEM mock server. SentinelOne, CrowdStrike, Defender, Elastic, Cortex XDR, Splunk, M365 and Sentinel — 8 platforms in one proces

ClickDetect is a vendor-agnostic alerting framework for threshold-based detection. It works with ClickHouse, OpenSearch/Elasticsearch, Victo

Fast, zero-dependency access log analyzer, security threat inspector, and TUI dashboard for Caddy v2

🛡️Self-hosted security analytics & threat detection for Discord servers. Real-time phishing, raids, spam detection. Privacy-first with GDPR

SunnyDayBPF: eBPF-based post-syscall user-buffer telemetry deception research by Azizcan Daştan

Finds the detection rules in your SIEM that are running blind

Open-source enterprise SOC platform — SIEM · SOAR · EDR · DPI · MDM · NGFW in one stack. Self-host in minutes.

Convert Sigma detection rules to production-ready Wazuh XML. CLI tool with batch processing, ZIP input, field mapping, and config file suppo

Finance & Banking - Advanced Threat Intelligence Plt. & Dynamic Policy Enforcer that ingests OSINT threat feeds, normalizes & scores indicat

Zero-dependency Python CLI for deep security auditing of FortiGate configurations. 5695 lines, 35 audit domains, 300+ checks — firewall poli