Awesome Cybersecurity Blue Team
Section: Network Security Monitoring (NSM) · Full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes.
StaleScore 53
Entry
Stenographer
Appears in 5 awesome lists
Packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. It stores as much history as it possible, managing disk usage, and deleting when disk limits are hit. It's ideal for capturing the traffic just before and during…
Open github.comgoogle/stenographer
Found in these lists
Awesome Cybersecurity Blue Team - CN
Section: 网络安全监控（NSM） · 可进行全包捕获的实用程序，用于将数据包缓冲到磁盘以进行入侵检测和事件响应
StaleScore 47
Awesome Incident Response
Section: Other Tools · Packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. It stores as much history as it possible, managing disk usage, and deleting when disk limits are hit. It's ideal for capturing the traffic just before and during…
ActiveScore 82
Awesome Security
Section: Full Packet Capture / Forensic · Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets.
SlowScore 70
Awesome Threat Detection and Hunting
Section: Network Monitoring · A full-packet-capture tool
SlowScore 61
Often listed next to it
Wireshark
Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Wireshark is very similar to tcpdump, but has a graphical front-end, plus some integrated sorting and filtering options.
In 20 listsDetails
Snort
Snort is a free and open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS)created by Martin Roesch in 1998. Snort is now developed by Sourcefire, of which Roesch is the founder and CTO. In 2009, Snort entered InfoWorld's Open Source Hall of Fame as one…
In 9 listsDetails
Zeek
(formerly Bro) is an open source software platform that provides compact, high-fidelity transaction logs, file content, and fully customized output to analysts, from the smallest home office to the largest, fastest research and commercial networks. From the FAQ: "Zeek provides a comprehensive…
In 6 listsDetails
Maltrail
A malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails and featuring an reporting and analysis interface.
In 5 listsDetails
Tsunami
A general purpose network security scanner with an extensible plugin system for detecting high severity RCE-like vulnerabilities with high confidence. Custom detectors for finding vulnerabilities (e.g. open APIs) can be added.
In 3 lists
rastrea2r
Multi-platform tool for triaging suspected IOCs on many endpoints simultaneously and that integrates with antivirus consoles.
In 4 lists
HELK
All-in-one Free Software threat hunting stack based on Elasticsearch, Logstash, Kafka, and Kibana with various built-in integrations for analytics including Jupyter Notebook.
In 4 lists
Arkime
Augments your current security infrastructure to store and index network traffic in standard PCAP format, providing fast, indexed access.
In 4 lists