S1EM - This project is a SIEM with SIRP and Threat Intel,

项目说明

!20210518_
<div>
<p align="center">
<a href=" target"_blank"><img src=" alt="Discord"></a>
<img src="
<img src="
<a href=" target"_blank"><img src="
</p>
</div>

Objectives

Today, cyber attacks are more numerous and cause damage in companies. Ne, many software products exist to detect cyber threats. The S1EM solution is based on the principle of bringing together the best products in their field, free of charge, and making them quickly interoperable.

S1EM is a SIEM with SIRP and Threat Intel, a full packet capture, all in one.

Inside the solution:

* Elasticsearch ( 1 node or Cluster )
* Kibana
* Filebeat
* Logstash
* Metricbeat
* Heartbeat
* Auditbeat
* Fleet
* N8n
* Zircolite
*
* Spiderfoot
* Syslog-ng
* Elastalert
* TheHive
* Cortex ( With Mwdb, Capa, Yara, FileInfo, AssemblyLine )
* MISP
* OpenCTI
* Arkime
* Suricata
* Zeek
* Mwdb
* Traefik
* Codimd
* Watchtower
* Homer

!S1EM

Guides

:exclamation:Installation Guide

Access Guide

Configuration Guide

Upgrade guide

Detection Guide

Incident Response Guide

Threat Intel Guide

Agent Guide

Architecture Guide

Troubleshooting Guide

SOAR

Use EDR Elastic with S1EM

Use TPOT with S1EM

Screenshot of S1EM

Try S1EM

For EVTX File, you can try S1EM (Zircolite) with E. <br />
For Pcap File, you can try S1EM (Suricata/Zeek/Mwdb) with MALWARE-TRAFFIC-ANALYSIS.

Discord

The serveur discord of S1EM :

Roadmap

[ ] Add OpenCVE

[ ] The complete documentation

[ ] SSO

[ ] Interact with Lab-DFIR-SOC ()

[x] Add Capa ( In cortex )

[x] Add Zircolite

[x] Add

[ ] Installation of S1EM with Ansible

[ ] Integration in Secubian ()

[ ] Integration of T-POT ()

Related project

<br />
<br />
<br />
<br />
<br />
<br />
/>
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />

Special thanks

En français cette fois. <br />
Merci à mes amis et collègues qui m´ont inspiré toutes ces années, qui m´ont aidé, et corrigé des bugs.
Je pense à Kidrek, Juju, mlp1515, Wagga40, Xophidia, Ste, Frak113, HiPizzaa,et tous ceux qui n´ont pas forcement de compte github. <br />
Merci à vous :)

Liens github: <br />
<br />
<br />
<br />
<br />
<br />
<br />

Special thanks in english

Thanks to for your pull requests

Donate

If this project help you reduce time to develop, you can give me a cup of coffee :) <br />

![paypal]()

项目信息

开发语言：Shell

Star 数：463

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This project is a SIEM with SIRP and Threat Intel, all in one.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。