A modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral memory, and validates real-time anomalies using LLMs.

EFF-Monitoring是一款以内置 Agent 为核心的安全运营协作平台。平台围绕安全事件全生命周期，提供日志解析、资产关联、AI研判、处置流转、经验沉淀与报告输出等能力，通过证据驱动的分析与协同机制，帮助安全团队快速看懂告警、定位风险、联动上下游、提升处置效率。

Certified SOC Analyst (CSA) Program - A comprehensive 6-month, hands-on Security Operations Center training curriculum. Developed by Aminu Idris, AMCPN | International Cybersecurity and Digital Forensics Academy (ICDFA)

Yet another SoC Lab

A log-based Threat Hunting tool

SOC Analyst portfolyo projesi | 127 alert, 126 false positive, 1 gerçek tehdit, 6 kahve | SIEM/SOAR/EDR simülasyonu

An Email Analysis Tool with threat scoring, and URL/attachment safety checks for detecting phishing and malicious emails.

SHAP-Explained Agentic IDS: A 3-layer cybersecurity NIDS combining Random Forest, SHAP TreeExplainer, LangGraph Multi-Agent reasoning, and MART red-teaming.

It checks "www.zone-h.org/archive" and looks for your domains, if your assets found in the list, it sends its log to your Telegram or Bale group.

AgenticAnomaly is an indirect prompt injection CTF for testing how agentic security operations center (SOC) workflows can be exploited through indirect prompt injection.

CyberFortress-SmartXDR-Core provides the central AI-driven intelligence layer for the CyberFortress Intelligent SOC Ecosystem. It delivers alert triage, IOC enrichment, MITRE mapping, and automated response logic through a unified Flask-based AI gateway.

A series of open-source exploit proof of concept (PoC) for testing vulnerabilities and developing detection engineering rules

Enterprise-grade ICT infrastructure monitoring and security operations platform with Splunk. Demonstrates threat detection, Kenya Data Protection Act 2019 compliance, and 80% false positive reduction through alert tuning.

Attack simulation toolkit for testing Intelligent SOC Ecosystem detection capabilities, aligned with the MITRE ATT&CK framework.

AI-powered SOC pipeline — Wazuh + n8n + local LLM threat detection

IntruShield NIDS is an enterprise-grade Security Operations Center (SOC) platform & threat telemetry engine featuring real-time network intrusion detection powered by Suricata 7 DPI, async Python FastAPI, WebSockets, GeoIP enrichment, & Next.js 14.

TDARE is Threat Intelligence, Detection and Automatic Response integrated with Reverse Engineering.

Benchmark and scoring protocol for evaluating LLM-based SOC threat classification systems

AI Malware Static Analysis Tool 🔍 A CLI-based tool to perform static malware analysis on .exe or .apk files, extract IOCs, and optionally generate AI-driven threat summaries using AI Models. Designed to assist SOC teams and malware researchers in threat triage and reporting.

A Splunk-based detection and alerting system to identify brute-force attacks and login abuse across Linux SSH, Windows systems, web applications, and known malicious user-agents. Includes dashboards, alerts, saved searches, macros, and Slack/email notifications.