Open Source C++ Logging Software

Osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive. Osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.Osquery queries your devices like a database. Osquery uses basic SQL commands to leverage a relational data-model to describe a device. Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

Recursive computing and matching of Context Triggered Piecewise Hashing (aka Fuzzy Hashing). Supports Windows, *nix, BSD, OS X, etc.

This program allows you to explore the history of connecting usb drives after installing the system. Small size(19 kb with Gui). Very simple GUI. Export information to *.csv file. Enjoy!

ATTENTION: Snare Lite is unsupported legacy software. While it will remain a part of the SourceForge community, it is no longer secure and compliant. For up to date Snare software check out Snare Enterprise. https://www.snaresolutions.com/try-snare-for-free/ Snare Enterprise was created to keep up with the fast paced security software market. It started with the desire to create premium logging and SIEM tools that were agnostic by nature so they could be used to boost any SIEM architecture regardless of third party developers. In fact, the agnostic nature allows it to bridge gaps between multiple SIEM implementations across business units. For more on use cases, check out the Intersect Alliance website. https://www.snaresolutions.com/ Snare Enterprise’s premium features include: - Regulatory Compliance - TLS Encryption - Log Simulcasting - TCP – Guaranteed Log Delivery - USB Device Monitoring - And more! For updates follow us on social media!

justniffer is a TCP sniffer. It reassembles and reorders packets and displays the tcp flow in a customizable way. It can log network traffic in web server log format. It can also log network services performances (e.g. web server response times) and extract http content (images, html, scripts, etc)

A tool to monitor internet hosts` bandwidth usage in a Linux-NAT network. A daemon collects data and clients display them (currently a Java applet with a graph). It automatically detects new hosts and has a nice summary statistic.

NSAT is a fast, highly configurable, bulk network security scanner for over 50 different services and hundreds of vulnerabilities. It's main advantage is its flexibility and configurability.

loginote is a program to immediately display a note on screen (using xosd) when a user logs into the system or logs out again. Just imagine someone knows your password and you might be interested when he/she logs into your system.. ;). loginote will tell

alerttail tails a file and triggers events based on regex matching. Notify (libnotify), sys command, filtering and geoip localization actions are provided. Highly configurable via config file.

This project has been migrated to GitHub : https://github.com/vlachenal/anch-framework AnCH framework aims to provide utility classes for some common programming features. Features are implemented to be used as simply as possible. This framework was initially a way to test new C++ specifications (C++11) and to test C++ design patterns and tricks. Only POSIX systems are supported for now. Others could be supported later. (Partial) Doxygen documentation can be found on project home page.

Automated Security Tools (autosec) aims to provide automatic tools which network administrators may use to help check and test the security of their network.

ClamFS is a FUSE-based user-space file system for Linux with on-access anti-virus file scanning through clamd daemon. ClamFS has moved to Github. Please navigate to github.com/burghardt/clamfs.

A stable and fast Linux/Unix toolset to aid in the security and ease of use of *Nix.

Free Agents DIDS is a distributed intrusion detection system that you place on each host on your network. Agents intercommunicate with aes encryption, automatically alert you, and secure your network for free!

PHP packet2sql is a spawn of xant's packet2sql program. This program provides a PHP frontend to packet2sql and also enables packet2sql to work with both iptables and ipchains network filters (instead of just ipchains).

Remote Web Logger is a remote web transaction logging daemon. It operates by passive monitoring of web server traffic to translate web session data to transaction log entries that are written to standard log services such as syslog.

The Secure Remote Log Monitor (SRLM) project provides client and server utilities that collect application or system log files from multiple systems over an untrusted network onto a central server for analysis and action.

This tacky program hides itself in the subject’s PC (Windows XP or later), and silently records all keyboard and mouse operations. It is launched automatically with PC start, then stores data in ASCII code with record-date. Now all you have to do is- collect the record, and decode it.

Syslog X is a multithreaded syslog server and relay.

The Linux BSM is an auditing tool that aims to bring the capabilities of Sun's Solaris Basic Security Module to Linux.

This keylogger will say on the window that it is scanning files but it is actually logging keys (only characters and space, more willl come soon!!! Please enjoy Thylakoid! (supports ALL windows 32-bit versions

eEvidence Analyzer is an open source digital forensic analysis toolkit.

hawKeye, the next generation cyber-surveillance system

imntr (inode monitor) can be used to montior activity on files or directories. Monitoring is accomplished through the inotify API, which is available on Linux 2.6.13 and up. v1.1 added logging capabilities and cleaned up some of v1.0's code v1.2 no longer forces you to run imntr as root. If you want to monitor a privileged file, imntr will fail and tell you that you need to run imntr as root.

A linux kernel module and supporting user space environment which allow interception and modifying system calls that match user defined criteria. Think of it as strace on steroids.