Discover the best Threat Detection open source repositories on GitHub. Explore trending tools, live star counts, source code, and developer projects updated daily.
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
CVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security testing & research only.
Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.
Threat-hunting tool for Linux
Userland EDR for Windows. ETW telemetry, behavioral correlation, MITRE ATT&CK.