snort

⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐

Pulled Pork for Snort and Suricata rule management (from Google code)

Evasion by machine code de-optimization.

psad: Intrusion Detection and Log Analysis with iptables

A website and framework for testing NIDS detection

idstools: Snort and Suricata Rule and Event Utilities in Python (Including a Rule Update Tool)

Detection in the form of Yara, Snort and ClamAV signatures.

The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.

Programmatically create hunting rules for deserialization exploitation with multiple keywords, gadget chains, object types, encodings, and rule types

Snort FAQ

自己收藏的常用dockerfile

Snort IDS/IPS log analytics using the Elastic Stack.

CVE proof-of-concept labs, exploit scripts, and detection/prevention rules (Nginx, Apache, Snort, YARA) for high-severity CVEs. Authorized security testing & research only.

A website and framework for testing NIDS detection

Deploy pfelk with docker-compose

Collection of Snort 2/3 rules.

Collection of Suricata rule sets that I use modified to my environments.

IDS using a port mirror, Snort and an alert -> RESTCONF utility

Network Tools

SNORT GUI: sniff sniffs the baddies and helps you setup SNORT ids in your network