Skip to content
/ S1EM Public

This project is a SIEM with SIRP and Threat Intel, all in one.

License

Notifications You must be signed in to change notification settings

V1D1AN/S1EM

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

20210518_v1d1an_bg1--white

Objectives

Today, cyber attacks are more numerous and cause damage in companies. Nevertheless, many software products exist to detect cyber threats. The S1EM solution is based on the principle of bringing together the best products in their field, free of charge, and making them quickly interoperable.

S1EM is a SIEM with SIRP and Threat Intel, a full packet capture, all in one.

Inside the solution:

  • Elasticsearch ( 1 node or Cluster )
  • Kibana
  • Filebeat
  • Logstash
  • Metricbeat
  • Heartbeat
  • Auditbeat
  • Fleet
  • N8n
  • Zircolite
  • Velociraptor
  • Spiderfoot
  • Syslog-ng
  • Elastalert
  • TheHive
  • Cortex ( With Mwdb, Capa, Yara, FileInfo, AssemblyLine )
  • MISP
  • OpenCTI
  • Arkime
  • Suricata
  • Zeek
  • Mwdb
  • Traefik
  • Codimd
  • Watchtower
  • Homer

S1EM

Guides

Try S1EM

For EVTX File, you can try S1EM (Zircolite) with EVTX-ATTACK-SAMPLES.
For Pcap File, you can try S1EM (Suricata/Zeek/Mwdb) with MALWARE-TRAFFIC-ANALYSIS.

Discord

The serveur discord of S1EM : https://discord.gg/uFBzr8fWmC

Roadmap

Related project

https://www.elastic.co
https://github.com/TheHive-Project/Docker-Templates
https://github.com/jasonish/docker-suricata
https://github.com/blacktop/docker-zeek
https://github.com/rskntroot/arkime
https://github.com/coolacid/docker-misp
https://github.com/m0ns7er/ElasticXDR
https://github.com/jertel/elastalert-docker
https://github.com/OpenCTI-Platform/docker
https://github.com/CERT-Polska/mwdb-core
https://github.com/SigmaHQ/sigma
https://github.com/Yara-Rules/rules
https://traefik.io/
https://docs.linuxserver.io/images/docker-heimdall
https://github.com/cisagov/Malcolm
https://github.com/blueimp/jQuery-File-Upload
https://gchq.github.io/CyberChef/
https://www.syslog-ng.com/
https://github.com/bastienwirtz/homer
https://github.com/wagga40/zircolite
https://github.com/weslambert
https://github.com/Velocidex/velociraptor

Special thanks

En français cette fois.
Merci à mes amis et collègues qui m´ont inspiré toutes ces années, qui m´ont aidé, et corrigé des bugs. Je pense à Kidrek, Juju, mlp1515, Wagga40, Xophidia, StevenDias33, Frak113, HiPizzaa,et tous ceux qui n´ont pas forcement de compte github.
Merci à vous :)

Liens github:
https://github.com/kidrek
https://github.com/mlp1515
https://github.com/frack113
https://github.com/StevenDias33
https://github.com/wagga40
https://github.com/xophidia

Special thanks in english

Thanks to @Mcdave2k1 for your pull requests

Donate

If this project help you reduce time to develop, you can give me a cup of coffee :)

paypal