Open-Source Network Management, Monitoring, ITOM, Observability, and Security Analytics
This project consists of an open source library allowing software to connect to data repositories using STIX Patterning, and return results as STIX Observations.
Collector/Correlator, Embedded log-based WAF, AI Patterns Classifier
Open-source, self-hosted security pipeline for IT, AI and OT. Logs in. Evidence out.: OCSF normalization, 46 detection rules (MITRE/ATLAS/ICS-tagged), correlation, evidence packages, NIS2 drafts, rebuilt React console + GitHub Pages demo. Apache-2.0.
OXA - Open XDR architecture
OCSF-Tool: A command-line utility for managing Open Cybersecurity Schema Framework (OCSF) schemas, Supporting Proto file generation for OCSF Schemas.
Go implementation of Open Cybersecurity Schema Framework (OCSF) for standardized cybersecurity data handling, ensuring easy integration and high performance in Go applications.
Schema mappings in SQL and PySpark for ELT pipelines to normalize data to OCSF
Honeypot as code. Engage the adversary. Cultivate the data.
Console-IR. OCSF-native incident response and investigation TUI for the terminal. Triage findings, pivot on indicators, investigate hosts and accounts, GeoIP and WHOIS enrichment, case management, write the report. Single Go binary, SQLite, no server. Open Cybersecurity Schema Framework security tooling for SOC analysts and DFIR.
Extracts and structures Fortigate Log Reference documentation into machine-readable CSV schemas, and translates them into ECS and OCSF field mappings. Built for security engineers and data teams building parsers, normalization pipelines, or field references.
134 deterministic cloud & AI security skills — OCSF 1.8, MCP tools, HITL-gated remediation. AWS · GCP · Azure · K8s · SaaS.
Pure-Rust passive deep packet inspection for OT/ICS and IT — Modbus, DNP3, S7comm, OPC UA, IEC 61850, SMB2, Kerberos, LDAP. PCAP/PCAPNG → Bronze v2 / OCSF / InfluxDB. Zero C deps.
Open-source, self-hosted GRC evidence platform: collect read-only evidence, evaluate controls, and export reviewable audit workpapers.
Verifiable identity and tamper-evident OCSF audit records for AI agents — signed event chains, offline verification, agent mandates.
EKSIR — analyst-grade AI SOC workbench: deterministic triage + agent-persona LLM investigation with a human sign-off gate. Self-hostable, multi-tenant.
OCSF workbench CLI for normalizing, linting, explaining, diffing, and querying security events
Extracts and structures PAN-OS syslog field documentation into machine-readable CSV schemas, and translates them into ECS and OCSF field mappings. Built for security engineers and data teams building parsers, normalization pipelines, or field references.
To associate your repository with the ocsf topic, visit your repo's landing page and select "manage topics."