Browse & filter

Pattern matching for malware researchers—rules over files, memory, and streams in IR pipelines.

Network security monitor producing rich logs (conn, DNS, HTTP, SSL, files) for analytics—not a classic IDS signature engine.

Generic signature format for SIEM/detection rules convertible to Splunk, Elastic, KQL, and many backends.

Rapidly search and hunt through Windows event logs (EVTX) using Sigma-like rules and built-in threat detections.

Large-scale full packet capture, indexing, and search (SPIE) with a web UI—successor to the Moloch lineage for NSM teams.

Real Intelligence Threat Analytics: ingest Zeek logs to score beaconing, long connections, blacklisted DNS, and lateral patterns.