security-operations-center

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

Vigil SOC: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.

A modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral memory, and validates real-time anomalies using LLMs.

Comprehensive SOC Analyst notes covering incident response, threat hunting, SOC workflows, and cybersecurity concepts—perfect for exam prep and skill-building in blue team operations.

Ultimate Cybersecurity Roadmap (2025 Edition) | Beginner to Advanced Guide | Learn Ethical Hacking, SOC Analysis, Threat Hunting, Incident Response, and More by Shaikh Minhaj (Cyber With Minhaj)

Wazuh MCP Server: AI-Driven SOC Automation

This project automates SOC workflows using Wazuh, Shuffle, and TheHive. It involves setting up a Windows 10 client with Sysmon and Ubuntu 22.04 for Wazuh and TheHive, deployed on cloud or VMs. Goals: automate event collection, alerting, and incident response to enhance SOC efficiency.

EFF-Monitoring是一款面向安全运营场景的告警协作与 AI 研判平台。平台围绕安全事件全生命周期，提供AI研判、处置流转、经验沉淀、插件接入等能力，通过证据驱动的分析与协同机制，帮助安全团队快速看懂告警、定位风险、联动上下游并提升处置效率。

Certified SOC Analyst (CSA) Program - A comprehensive 6-month, hands-on Security Operations Center training curriculum. Developed by Aminu Idris, AMCPN | International Cybersecurity and Digital Forensics Academy (ICDFA)

The Enhanced MITRE ATT&CK® Coverage Tracker is an Excel tool for SOCs to measure and improve detection coverage of cyber threats. It simplifies tracking of security readiness against ATT&CK® tactics and techniques, offering a customizable, user-friendly interface for SOC analysts.

Threat Intelligence Analysis workflows built with n8n and integrated in SecurityOnion

The AI Autonomous SOC & Purple-Team Engine

Built a mini HoneyNet in Azure and ingest log sources from various resources into a Log Analytics workspace

监测漏洞，快速评估内部资产受影响程度，并处置闭环。Monitor vulnerabilities, rapidly assess their impact on internal assets, and close-loop remediation

A curated collection of essential resources, tools, and references for Security Operations Center (SOC) analysts.

The "Let's-defend-solution" directory contains the answers to all paths of the Let's Defend platform that were saved by the creator 8 months ago. These answers can be used by others who want to learn and practice their skills in cybersecurity.

A comprehensive SOC Analyst project that includes detection rules, attack simulations, automated responses, and SIEM configuration.

PythonSOCModules: Elevate your Security Operations Center (SOC) with Python's Paramiko, Requests, PyShark, Scapy, Matplotlib, and Seaborn modules. Strengthen security monitoring, incident detection, and response.

Yet another SoC Lab

A fully isolated, multi-VLAN Cybersecurity SOC Simulation Lab integrating pfSense firewall, Wazuh SIEM, Snort IDS/IPS, and target machines for realistic attack detection, log analysis, and threat simulation — designed to showcase professional detection engineering and network defense capabilities.