Defensive Security & Monitoring
Tools for protecting, detecting and responding: network and endpoint monitoring, logging and SIEM, digital forensics, incident response and hardening.
Mate Security
Mate Security is an AI SOC platform whose agents triage and investigate every alert, hunt threats from CTI reports, tune detections, and take response actions.
Defensive Security & MonitoringPaid
LuLu
LuLu is a free, open-source macOS firewall from Objective-See that alerts you when an app or process tries to make a new outgoing network connection.
Huntress
Huntress is a managed security platform with EDR, ITDR, SIEM, and security awareness training, all backed by a 24/7 SOC for businesses of all sizes.
Defensive Security & MonitoringPaid
OpenSCAP
OpenSCAP is a free SCAP toolkit used to evaluate configuration baselines and vulnerability content on Linux hosts for compliance and security teams.
Lynis
Lynis is a free host auditing tool used to scan Linux, macOS, and UNIX systems for hardening gaps for system administrators and defensive teams.
Defensive Security & MonitoringFreeOpen source
Falco
Falco is a free open-source runtime security tool used to detect suspicious behavior in hosts, containers, and Kubernetes in real time for cloud security teams.
PingCastle
PingCastle is a freemium Active Directory audit tool used to score domain risk and find weak settings in AD and Entra ID for IT and security teams.
Sysinternals Suite
Sysinternals Suite is a free Microsoft toolkit of Windows utilities used to inspect processes, startup items, and system activity for defenders and admins.
Defensive Security & MonitoringFree
Hayabusa
Hayabusa is a free open-source Windows event log tool used to build fast forensics timelines and hunt for attacker activity for incident responders.
Caldera
Caldera is a free automated adversary emulation platform used to run ATT&CK-based security tests for red teams and defenders validating their controls.
Atomic Red Team
Atomic Red Team is a free library of small ATT&CK-mapped tests used to validate detection and response coverage for blue teams and detection engineers.
Sigma
Sigma is a free open signature format used to write and share platform-neutral detection rules across SIEM tools for detection engineers and threat hunters.
Defensive Security & MonitoringFree
Kismet
Kismet is a free open-source wireless sniffer and WIDS used to detect Wi-Fi, Bluetooth, and RF devices for network defenders and authorized testers.
Wazuh
Wazuh is an open-source XDR and SIEM platform used to detect and investigate threats on endpoints, free to self-host, with a paid cloud service.
Defensive Security & MonitoringFreemiumOpen source
osquery
osquery is a host instrumentation tool used to query operating system state for detection engineers, and it is free under the Apache 2.0 or GPL 2.0 license.
Defensive Security & MonitoringFreeOpen source
Velociraptor
Velociraptor is a free open-source endpoint visibility and DFIR platform for collecting and hunting host artifacts across authorized estates.
CyberChef
CyberChef is a free open-source web app from GCHQ for encoding, decoding, hashing and transforming data during security analysis and investigations.
Defensive Security & MonitoringFreeOpen source
Zeek
Zeek is a free open-source network security monitor that passively analyses traffic into rich logs for detection, forensics and SIEM workflows.
Microsoft Sentinel
Microsoft Sentinel is Azure's cloud-native SIEM for log analytics, threat detection, investigation and automated SOC response.
Defensive Security & MonitoringPaid
Microsoft Defender for Endpoint
Cloud-native Microsoft endpoint protection with EDR, hunting and automated response across Windows, macOS, Linux, mobile and IoT.
Defensive Security & MonitoringPaid
Suricata
Suricata is an open-source network IDS, IPS and network security monitoring engine maintained by the Open Information Security Foundation (OISF).
Elastic Security
Elastic Security is Elastic’s SIEM and XDR solution for detecting, investigating and responding to threats across endpoints, cloud and security data.
Defensive Security & MonitoringFreemiumOpen source
Splunk
Splunk is a commercial data platform widely used for SIEM and security analytics, helping teams search, detect, investigate and respond to threats.
Defensive Security & MonitoringPaid
Volatility
Volatility is an open-source memory forensics framework for extracting digital artifacts from RAM dumps during incident response and malware analysis.
SentinelOne
Commercial AI-native EDR/XDR platform that protects endpoints and extends detection and response across identity, cloud and security operations.
Defensive Security & MonitoringPaid
CrowdStrike
CrowdStrike Falcon is a cloud-delivered cybersecurity platform focused on endpoint detection, prevention and response for enterprise environments.
Defensive Security & MonitoringPaid
Recorded Future
Commercial threat intelligence platform that correlates open-web, dark-web and technical signals to help teams prioritize cyber risk.
VirusTotal
Online multi-engine scanner for analyzing files, URLs, domains and IPs for malware signals, with free public and paid tiers.
1Password
Commercial credential vault and access platform for passwords, passkeys and secrets across individuals, families and organizations.
Wiz
Commercial cloud and AI security platform that maps code, cloud and runtime into a security graph to prioritise exploitable risk.
Cloud SecurityPaid