Detection and Monitoring

Free and open-source options for network and host visibility:

NIDS

Suricata

Modern network detection with protocol awareness, signature support, and strong community adoption.

suricata.ioNIDS

Snort

A long-standing intrusion detection option that still matters in many labs and legacy environments.

snort.orgLog monitoring

Sagan

Real-time log analysis that can complement network-focused tooling with event-driven detection.

github.com/quadrantsec/saganThreat trails

Maltrail

Traffic monitoring tuned for malicious indicators and suspicious communications on the wire.

github.com/stamparm/maltrailNSM

Zeek

Excellent network security monitoring and protocol-rich telemetry when you want deeper network context than alerts alone.

zeek.orgPacket visibility

Arkime

Large-scale packet capture and indexing that helps with retrospective analysis and hunt-heavy workflows.

github.com/arkime/arkime

Host and Endpoint Visibility

Open XDR / SIEM

Wazuh

Broad endpoint and security monitoring with log analysis, integrity monitoring, and alerting across diverse environments.

wazuh.comHost telemetry

osquery

Query operating system state like a database for host inventory, detection ideas, and investigation pivots.

github.com/osquery/osqueryRuntime detection

Falco

Cloud and container runtime detection for suspicious process behavior, Kubernetes events, and host activity.

falco.org

Hunt and Triage

DFIR and hunt ops

Velociraptor

Excellent for endpoint collection, live response, and hunt-heavy workflows when you need more than passive telemetry.

docs.velociraptor.appEvent log triage

Chainsaw

Very handy for rapid Windows event log triage and Sigma-backed hunting without standing up a full SIEM first.

github.com/countercept/chainsawIOC scanning

Loki

Still useful for lightweight host scanning with IOC, filename, and YARA-style checks during triage.

github.com/Neo23x0/LokiDetection language

Sigma

A core resource for portable log detections when you want rules that can travel across different SIEMs and backends.

sigmahq.ioPattern matching

YARA

Still a foundational tool for identifying, tagging, and classifying suspicious files during malware triage and hunt work.

virustotal.github.io/yaraCapability analysis

capa

Useful for quickly surfacing what a binary appears capable of doing before you commit to deeper reverse engineering.

github.com/mandiant/capa

Detection and Classification

IOC scanner

Fenrir

A more modern companion to Loki-style triage when you want quick live detection and artifact collection on Windows hosts.

github.com/Neo23x0/FenrirString recovery

FLOSS

Helpful for recovering obfuscated and decoded strings from malware samples as part of classification and triage workflows.

github.com/mandiant/flare-flossHunting stack

HELK

A hunt-oriented ELK stack that is useful when you want a lab-friendly environment focused on detection engineering and ATT&CK-style analytics.

github.com/Cyb3rWard0g/HELKWindows event triage

DeepBlueCLI

Useful for quickly surfacing suspicious patterns in Windows Event Logs during triage without standing up a full analysis stack.

github.com/sans-blue-team/DeepBlueCLI

Incident Response and Forensics

Disk and host forensics

Autopsy

A dependable starting point for host forensics, disk-image review, and evidence triage when an investigation moves beyond alerting.

sleuthkit.orgMemory forensics

Volatility

Still one of the core memory-analysis frameworks when you need to inspect processes, injected code, handles, and in-memory artifacts.

volatilityfoundation.orgRegistry analysis

RegRipper

Very useful for extracting timeline and persistence clues from Windows Registry hives during host triage.

github.com/keydet89/RegRipper3.0Artifact collection

KAPE

A staple for fast evidence collection and targeted triage when you need useful host artifacts quickly instead of a full forensic image.

kroll.comDecode and transform

CyberChef

Perfect for quickly decoding, converting, unpacking, and sanity-checking suspicious strings, blobs, and encodings during investigations.

github.com/gchq/CyberChefDocument and artifact triage

Didier Stevens Suite

A long-running collection of small, extremely useful analysis tools for PDFs, Office docs, archives, encodings, and odd file artifacts.

blog.didierstevens.comATT&CK mapping

ATT&CK Navigator

Helpful for mapping detections, observed techniques, and coverage gaps when you want a cleaner way to reason about ATT&CK content.

mitre-attack.github.ioZeek and PCAP triage

Brim

Excellent for searching Zeek logs and packet captures quickly when an investigation leans heavily on network evidence.

brimdata.ioNetwork telemetry

VAST

A strong option for large-scale network telemetry and investigation workflows when packet and flow data become the center of the hunt.

vast.io

Full Monitoring Stacks

Blue team distro

Security Onion

A packaged monitoring stack for threat hunting, enterprise security monitoring, and log management.

securityonionsolutions.com

Shoutout to big maintained collections like awesome-malware-analysis, awesome-incident-response, awesome-cyber-security-tools, and awesome-threat-detection, which are helpful for cross-checking gaps in detection, triage, and DFIR workflows.