security-operations-center

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

Vigil: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.

A modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral memory, and validates real-time anomalies using LLMs.

Comprehensive SOC Analyst notes covering incident response, threat hunting, SOC workflows, and cybersecurity concepts—perfect for exam prep and skill-building in blue team operations.

Ultimate Cybersecurity Roadmap (2025 Edition) | Beginner to Advanced Guide | Learn Ethical Hacking, SOC Analysis, Threat Hunting, Incident Response, and More by Shaikh Minhaj (Cyber With Minhaj)

Wazuh MCP Server: AI-Driven SOC Automation

This project automates SOC workflows using Wazuh, Shuffle, and TheHive. It involves setting up a Windows 10 client with Sysmon and Ubuntu 22.04 for Wazuh and TheHive, deployed on cloud or VMs. Goals: automate event collection, alerting, and incident response to enhance SOC efficiency.

EFF-Monitoring是一款面向安全运营场景的告警协作与 AI 研判平台。平台围绕安全事件全生命周期，提供AI研判、处置流转、经验沉淀、插件接入等能力，通过证据驱动的分析与协同机制，帮助安全团队快速看懂告警、定位风险、联动上下游并提升处置效率。

Threat Intelligence Analysis workflows built with n8n and integrated in SecurityOnion

Certified SOC Analyst (CSA) Program - A comprehensive 6-month, hands-on Security Operations Center training curriculum. Developed by Aminu Idris, AMCPN | International Cybersecurity and Digital Forensics Academy (ICDFA)

The Enhanced MITRE ATT&CK® Coverage Tracker is an Excel tool for SOCs to measure and improve detection coverage of cyber threats. It simplifies tracking of security readiness against ATT&CK® tactics and techniques, offering a customizable, user-friendly interface for SOC analysts.

The AI Autonomous SOC & Purple-Team Engine

Built a mini HoneyNet in Azure and ingest log sources from various resources into a Log Analytics workspace

监测漏洞，快速评估内部资产受影响程度，并处置闭环。Monitor vulnerabilities, rapidly assess their impact on internal assets, and close-loop remediation

A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts.

The "Let's-defend-solution" directory contains the answers to all paths of the Let's Defend platform that were saved by the creator 8 months ago. These answers can be used by others who want to learn and practice their skills in cybersecurity.

A comprehensive SOC Analyst project that includes detection rules, attack simulations, automated responses, and SIEM configuration.

PythonSOCModules: Elevate your Security Operations Center (SOC) with Python's Paramiko, Requests, PyShark, Scapy, Matplotlib, and Seaborn modules. Strengthen security monitoring, incident detection, and response.

Yet another SoC Lab

The Security Maturity Project Tracking Matrix helps organizations evaluate and enhance their security capabilities across multiple domains. It provides a structured framework to track progress, streamline processes, and achieve security maturity goals effectively.