wazuh / wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

tstack / lnav

Log file navigator

logpai / loghub

A large collection of system log datasets for AI-driven log analytics [ISSRE'23]

Johnng007 / Live-Forensicator

Cross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.

shanananana / deepticket

An AI troubleshooting workbench for internal systems: it integrates ticketing and alerting systems via HTTP APIs and webhooks, connects code, logs, configurations, and agents, and provides a web-based self-service analysis interface for product, operations, and customer support teams.

Graylog2 / graylog2-server

Free and open log management

dimonomid / nerdlog

Nerdlog: fast, remote-first, multi-host TUI log viewer with timeline histogram and no central server

tirrenotechnologies / tirreno

tirreno is an open-source framework for building sovereign security, compliance and fraud prevention applications. Detect account takeovers, cyberfraud and business logic abuse inside your product.

Lifailon / lazyjournal

TUI for viewing logs from journald, auditd, file system, Docker and Podman containers, Compose stacks and Kubernetes pods with support for log highlighting and several filtering modes.

wazuh / wazuh-docker

Wazuh - Docker containers

activecm / rita

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

utmstack / UTMStack

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

turbot / tailpipe

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

wazuh / wazuh-dashboard-plugins

Plugins for Wazuh Dashboard

vmaltarello / whyd

Find out why your Linux PC froze, crashed or shut down: whyd reads the journal of the previous boot and tells you in one screen.

MangoGreenTeaz / FaultLens

Local-first, explainable log incident diagnosis for developers and CI/CD.

cn0xroot / CC-Monitor

Claude Code Monitor : Monitor & audit every action Claude Code takes on your computer.

lenny-ts / caddy-analyzer

Fast, zero-dependency access log analyzer, security threat inspector, and TUI dashboard for Caddy v2

mahialjaber / SOC-Log-Analysis-Datasets

Curated, simulated dataset of security logs (Windows, Web, Firewall, Cloud) with embedded attack vectors for SOC analysts to practice SIEM ingestion, threat hunting, and log analysis.

JoasASantos / NeuroPurple

The AI Autonomous SOC & Purple-Team Engine