All projects
Repositories in this selection 6 · UTC 2026-11-04
CompareRankProjectStarFork30-day trend7-day net changeLast pushSign in to save
1—Zzeek / zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.C++NOASSERTION · Restricted / unknownInsufficient rank history8,1671,443——2026-11-03
2—Iivre / ivreNetwork recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.PythonGPL-3.0 · Share derivative sourceInsufficient rank history4,193702——2026-10-30
3—Ccisagov / MalcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.PythonNOASSERTION · Restricted / unknownInsufficient rank history2,577455——2026-10-29
4—Sstratosphereips / StratosphereLinuxIPSSlips, a free software behavioral Python intrusion prevention system (IDS/IPS) that uses machine learning to detect malicious behaviors in the network traffic. Stratosphere Laboratory, AIC, FEL, CVUT in Prague.PythonGPL-2.0 · Share derivative sourceInsufficient rank history901208——2026-11-02
5—Ttenzir / tenzirTenzir is the data pipeline engine for security teams.C++BSD-3-Clause · PermissiveInsufficient rank history770110——2026-11-02
6—Hhelixmap / sigwoodLocal-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.PythonMIT · PermissiveInsufficient rank history34514——2026-10-29
License tiers are derived from metadata. Check obligations for your use; unknown does not mean prohibited.