Open source tools for SOC: my own list

A SOC, or Security Operations Center, is a centralized unit within an organization responsible for the detection, analysis, and response to cyber threats and vulnerabilities.

It is typically responsible for managing and monitoring the security of an organization’s networks, systems, and data.

Using open source software in a SOC can be beneficial for a number of reasons:

Cost: Open source software is typically free to use, which can significantly reduce the costs associated with purchasing and maintaining proprietary software.
Customization: Open source software allows users to modify and customize the code to meet their specific needs, which can be useful in a SOC where specific security requirements may vary from one organization to another.
Security: Many open source software projects have a large and active community of developers and users who contribute to and test the code, which can result in more secure software compared to proprietary alternatives.
Collaboration: The open nature of open source software allows for collaboration and sharing of ideas between different organizations and individuals, which can be beneficial in a SOC where sharing information and best practices can help improve overall security.
Flexibility: Open source software allows users to choose their own hardware and operating systems, giving them more flexibility in how they use and deploy the software in their SOC.

The following is a list of open source tools that I find useful.

SIEM

AlienVault OSSIM

Open source SIEM tool by AT&T, based on its AlienVault USM solution.

AlienVault OSSIM brings together many open source projects into a single package, close to the entries above, and also allows application tracking and logging.

OSSEC

Technically, OSSEC is an open source intrusion detection system rather than a SIEM solution. However, it still provides a host agent to collect logs and a central application to process those logs.

Overall, this tool monitors log files and file integrity for potential cyber attacks. It can perform log analysis of various network services and provide your IT staff with numerous alerting options.

Wazuh

In fact, Wazuh evolved from OSSEC, which is open source, implementing a dedicated web interface and detailed guidelines for quick IT administrator control.

OSS Prelude

Open-source version of Prelude SIEM. This helps you work with a wide variety of log formats and other features.

It can also normalize event data into a common language, which can support other cybersecurity tools and solutions. Prelude OSS also profits from continued growth, while maintaining the current intelligence threat.

Snort

Snort also offers log monitoring as another open source intrusion detection system; it also performs real-time network traffic analysis to identify potential dangers.

Snort can also view traffic or packet dump flows in a log file. In addition, output plugins can be used to decide how and where the dataset is saved.

Sagan

A multi-threads, high performance log analysis engine: the Sagan structure and Sagan rules work similarly to the Suricata & Snort IDS engine.

Sagan is lightweight and can write to databases on snort. It can be another useful resource for anyone who would like to collaborate with Snort.

SIEMonster

SIEMonster provides a free SIEM and a paid solution.

As is the case with many of the solutions used, the SIEMonster framework provides a centralized tool management interface for data analysis, threat intelligence and various open source software.

IDS/IPS/Firewall

SecurityOnion

Security Onion is an open source intrusion detection tool, network monitoring protection system and log management distribution for enterprise security on Linux.

Zeek

Zeek is a passive, open-source network traffic analyzer.

Zeek also supports a wide range of traffic analysis tasks beyond the security domain, including performance measurement and troubleshooting.

Smoothwall Express

Smoothwall Express is an open source firewall that features an easy-to-use web interface and a separate, stable Linux operating system.

The functionality involves LAN, DMZ and wireless network support, real-time content filtering and HTTPS filtering.

Incident Response Tools

GRR quick response

Google’s GRR quick response consists of two parts: one GRR client deployed in an investigated network and a GRR server that assists analysts in applying actions and processing the collected data.

Volatility

In my opinion, the best forensic framework for analysis of memory dumps.

SIFT (Sans Investigative Forensics Toolkit) Workstation

SIFT Workstation is a Ubuntu tools with all the necessary analysis systems to conduct comprehensive digital forensics work.

The Hive Project

The Hive Project is a free, open source IR framework that allows many researchers to conduct incident investigations at the same time.

This helps analysts produce new role assignment updates and display events and warnings from multiple sources, including SIEM alerts.

Malware Analysis Tools

Cuckoo Sandbox

Cuckoo Sandbox is a free malware analyze tool that automates the task of analyzing any malicious file under Windows, MacOS, Linux, and Android.

YARA

YARA is a tool developed by VirusTotal in order to help malware researchers to identify and classify malware samples.

It offers a regulatory method for generating malware family definitions based on textual or binary patterns.

The REMnux

The REMnux project provides a lightweight, malicious software Linux distribution for malware analysis.

Threat Intelligence Tools

MISP

MISP (Malware information sharing platform) is a threat intelligence platform for gathering, sharing, storing and correlating Indicators of Commitment of targeted attacks, threat intelligence, financial fraud information, vulnerability information or even counter-terrorism information.

TIH

TIH (Threat-Intelligence-Hunter) is an intelligence tool that helps you in searching for IOCs across multiple openly available security feeds and some well-known APIs. own set of indicators.

QRadio

QRadio is a tool/framework designed to consolidate cyber intelligence threats sources.

The goal of the project is to establish a robust modular framework for extraction of intelligence data from vetted sources.

Machinae Security Intelligence Collector

Machinae is aa tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints.