MozDef - MozDef: The Mozilla Defense Platform

•    Javascript

The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.The Mozilla Defense Platform (MozDef) seeks to automate the security incident handling process and facilitate the real-time activities of incident handlers.

container

•    Python

This repository (formerly known as orchestration-workshop) contains materials (slides, scripts, demo app, and other code samples) used for various workshops, tutorials, and training sessions around the themes of Docker, containers, and orchestration. If you're looking for the materials, you can stop reading right now, and hop to http://container.training/, which hosts all the slides decks available.

elk-docker - Elasticsearch, Logstash, Kibana (ELK) Docker image

•    Shell

This Docker image provides a convenient centralised log server and log management web interface, by packaging Elasticsearch, Logstash, and Kibana, collectively known as ELK. See the ELK Docker image documentation web page for complete instructions on how to use this image.

docker-elk - The ELK stack powered by Docker and Compose.

•    Dockerfile

Run the latest version of the Elastic stack with Docker and Docker Compose. It will give you the ability to analyze any data set by using the searching/aggregation capabilities of Elasticsearch and the visualization power of Kibana.

elastiflow - Network flow Monitoring (Netflow, sFlow and IPFIX) with the Elastic Stack

•    Shell

ElastiFlow provides network flow data collection and visualization using the Elastic Stack (Elasticsearch, Logstash and Kibana). It supports Netflow v5/v9, sFlow and IPFIX flow types (1.x versions support only Netflow v5/v9).

ELK - 搭建ELK日志分析平台。

搭建ELK日志分析平台。

HELK - The Incredible HELK

•    Shell

A Hunting ELK (Elasticsearch, Logstash, Kibana) with advanced analytic capabilities.At the end of the HELK installation, you will have a similar output with the information you need to access the primary HELK components. Remember that the default username and password for the HELK are helk:hunting.

JustLog - JustLog brings logging on iOS to the next level

•    Swift

JustLog takes logging on iOS to the next level. It supports console, file and remote Logstash logging via TCP socket with no effort. Support for logz.io available. At Just Eat, logging and monitoring are fundamental parts of our job as engineers. Whether you are a back-end engineer or a front-end one, you'll often find yourself in the situation where understanding how your software behaves in production is important, if not critical. The ELK stack for real-time logging has gained great adoption over recent years, mainly in the back-end world where multiple microservices often interact with each other.

go-stash - go-stash is a high performance, free and open source server-side data processing pipeline that ingests data from Kafka, processes it, and then sends it to ElasticSearch

•    Go

go-stash is a high performance, free and open source server-side data processing pipeline that ingests data from Kafka, processes it, and then sends it to ElasticSearch.

dsiem - Security event correlation engine for ELK stack

•    Go

Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, and produces risk-adjusted alarms.

logagent-js - Extensible log shipper with input/output plugins, buffering, parsing, data masking, and small memory/CPU footprint

•    Javascript

Smart log parser written in Node

docker_monitoring_logging_alerting - Docker host and container monitoring, logging and alerting out of the box using cAdvisor, Prometheus, Grafana for monitoring, Elasticsearch, Kibana and Logstash for logging and elastalert and Alertmanager for alerting

•    Roff

Blog post on Medium with some more elaboration.This is a secure out-of-the-box monitoring, logging and alerting suite for Docker-hosts and their containers, complete with dashboards to monitor and explore your host and container logs and metrics.

elk - :telephone: Ruby API client for 46elks messaging service

•    Ruby

Ruby client for 46elks "Voice, SMS & MMS" service. https://www.46elks.com/ At the moment the API only supports sending SMS messages. Elk uses rspec and webmock for testing, do a bundle install for all the development requirements.

elk-windows-installer - Elasticsearch Logstash Kibana Windows Installer

•    NSIS

Here you can find an installer for the ELK stack (Elasticsearch - Logstash - Kibana) for Windows. There are a few tutorials on the internet that describe how to do this operation manually. This installer is designed to install the required files and install the ELK services on the system hopefully saving you some time in the process. You can download the installer from the releases section.

ansible-role-elasticsearch - Ansible Role - Elasticsearch

An Ansible Role that installs Elasticsearch on RedHat/CentOS or Debian/Ubuntu. Requires at least Java 7 (Java 8+ preferred). See geerlingguy.java role instructions for installing OpenJDK 8.

ansible-role-elasticsearch-curator - Ansible Role - Elasticsearch Curator

An Ansible Role that installs Elasticsearch Curator on RedHat/CentOS or Debian/Ubuntu. On RedHat/CentOS, make sure you have the EPEL repository configured, so the python-pip package can be installed. You can install the EPEL repo by simply adding geerlingguy.repo-epel to your playbook's roles.

ansible-role-filebeat - Ansible Role - Filebeat for ELK stack

An Ansible Role that installs Filebeat on RedHat/CentOS or Debian/Ubuntu. None.

ansible-role-kibana - Ansible Role - Kibana

An Ansible Role that installs Kibana on RedHat/CentOS or Debian/Ubuntu. None.

ansible-role-logstash - Ansible Role - Logstash

An Ansible Role that installs Logstash on RedHat/CentOS Debian/Ubuntu. Note that this role installs a syslog grok pattern by default; if you want to add more filters, please add them inside the /etc/logstash/conf.d/ directory. As an example, you could create a file named 13-myapp.conf with the appropriate grok filter and restart logstash to start using it. Test your grok regex using the Grok Debugger.

ansible-role-logstash-forwarder - Ansible Role - Logstash Forwarder

•    Shell

An Ansible Role that installs Logstash Forwarder on RedHat/CentOS or Debian/Ubuntu. None.