Browse & filter

Pattern matching for malware researchers—rules over files, memory, and streams in IR pipelines.

High-performance IDS/IPS and network security monitoring with multi-threading, TLS inspection options, and Lua scripting.

Cloud-native runtime security for Linux/Kubernetes: syscall and K8s audit rules with Falcoctl and ecosystem outputs.

Linux runtime security using eBPF to trace OS and container events with prebuilt signatures and pipeline exports.

Generic signature format for SIEM/detection rules convertible to Splunk, Elastic, KQL, and many backends.

eBPF-based security observability and runtime enforcement: process/exec monitoring, network hooks, and kill primitives integrated with Cilium.

Open Windows EDR-oriented agent using Sysmon/ETW feeds with detection-driven artifact collection and MISP/Elastic export.

Thinkst low-interaction honeypot daemon emulating services (SSH, HTTP, SMB, etc.) to generate tamper-evident intrusion signals.