BRO/Zeek IDS content pack contains pipeline rules, a stream, a dashboard displaying interesting activity, and a syslog tcp input to capture and index BRO/Zeek logs coming from a remote sensor.
-
Updated
Apr 12, 2020
#
security-onion
Here are 45 public repositories matching this topic...
This project aims to enhance intrusion detection using Security Onion by integrating machine learning models for improved alert prioritization.
python security data-science machine-learning jupyter-notebook cybersecurity network-security intrusion-detection-system security-onion
-
Updated
Sep 25, 2024 - Jupyter Notebook
Code, labs and supporting materials for the book Industrial Cybersecurity, 2nd Edition
elasticsearch book lab cybersecurity threat-hunting ics scada ot security-onion wazuh industrial-control-systems
-
Updated
Sep 12, 2026 - Python
Collection of PatternDB files to parse Ubiquiti Unifi events into Security Onion's Syslog-NG and ELSA
-
Updated
Apr 24, 2017
Elasticsearch ingest pipeline for ASUS ROG router syslog in Security Onion 3.1
-
Updated
Jul 20, 2026 - Python
Evidence-backed SOC L1 portfolio: 100 detection and investigation scenarios across 16 MITRE ATT&CK categories — including false-positive triage, proactive threat hunting, and insider-threat analysis. From a segmented enterprise lab, entirely open-source.
incident-response active-directory dfir cybersecurity threat-hunting siem soc security-onion wazuh blue-team mitre-attack detection-engineering
-
Updated
Sep 16, 2026
Test your IDS with a simple python2.7 SCAPY tool.
-
Updated
Apr 20, 2018 - Python
YARA signature | YARA rule for Detecting Voldemort Malware
splunk malware threat-hunting cuckoo yara security-onion soar edr voldemort yara-rule voldemort-malware
-
Updated
Sep 9, 2024 - YARA
AstoraSOC is an open-source SOC and Incident Response platform for SIEM alert triage, case management, IOC intelligence, asset correlation, containment workflows, and professional reports
ioc splunk incident-response dfir cybersecurity siem case-management soc threat-intelligence security-onion wazuh soar qradar security-operations microsoft-sentinel elastic-security open-source-soc
-
Updated
Jul 18, 2026 - Python
Security Onion Packet Capture Download scripts
-
Updated
Nov 10, 2019 - Python
Standalone Security Onion Setup + Network Simulation using Two Devices
-
Updated
Jul 6, 2024
Security Operations Center: pfSense firewall, Security Onion IDS/IPS, Splunk SIEM, Wazuh EDR and Microsoft Defender for Endpoint — multi-layered threat monitoring, detection and incident response
splunk incident-response cybersecurity siem pfsense soc network-security security-onion wazuh security-lab security-operations-center
-
Updated
Jan 12, 2026
A Security Onion deployment project for intrusion detection and log analysis. Includes standalone, pfSense, internal, and cloud scenarios with Suricata, Zeek, Wazuh, and ELK stack integration.
-
Updated
Aug 12, 2025
Presenting a guide and systematic methodology for implementing securityonion / ELK elastic search stack. Checklists, Samples, Tips, and Tricks
-
Updated
Dec 29, 2020
Self-hosted LLM triage for Security Onion alerts
-
Updated
Sep 4, 2026 - Python
Full penetration test & SOC monitoring lab — Kali Linux, Metasploit, Security Onion 3.0
vagrant kibana cybersecurity penetration-testing suricata siem kali-linux ethical-hacking red-team metasploit security-onion blue-team
-
Updated
Apr 24, 2026
Security Onion
-
Updated
Apr 10, 2026 - Shell
Security Onion SOC home lab using Kali Linux and Ubuntu to generate, detect and investigate network activity with Suricata, Alerts, Hunt and PCAP.
linux virtualbox incident-response cybersecurity nmap suricata network-analysis soc homelab network-security security-onion blue-team
-
Updated
Aug 13, 2026
Hands-on cybersecurity home lab: Security Onion SIEM/IDS, Windows Server 2025, Active Directory, incident response, SOC analyst skills.
incident-response active-directory cybersecurity windows-server siem homelab security-onion blue-team soc-analyst
-
Updated
Jul 11, 2026
Add this topic to your repo
To associate your repository with the security-onion topic, visit your repo's landing page and select "manage topics."