Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, and case management. It also includes other tools such as Playbook, osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

Digging Deeper....

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)

Tinfoil Chat - Onion-routed, endpoint secure messaging system

Red Canary Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research. Beginning with Endpoint Security (ES), it collects and enriches system events, displaying them graphically, with an expansive feature set designed to reduce noise.

Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.

A desktop application that checks security-related settings and makes recommendations for improvements without requiring central device management or automated reporting.

Awesome list of keywords and artifacts for Threat Hunting sessions

Fast and efficient osquery management

系统监控开发套件（sysmon、procmon、edr、终端安全、主机安全、零信任、上网行为管理、沙箱）

Automatically audit your Mac for basic security hygiene.

monitor macOS for malicious activity

Endpoint detection & Malware analysis software

iDefender（冰盾 - 终端主动防御系统）

Authorization extension for popular web-frameworks to protect your endpoints

Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.

Collection of tool you need to have in your Endpoint Detection and Response arsenal

Windows Exploit Protection Settings (Ultimate)

A macOS behavior audit / event monitoring system with scope of file, process and network events (based on Endpoint Security Framework).

Advanced threat detection solution for Linux.