Search Results for "correlation"

Simple Event Correlator (SEC) is a lightweight event correlator for network management, log file monitoring, security management, fraud detection, and other tasks which involve event correlation.

inspectIT is the leading open-source APM (application performance management) tool for monitoring and analyzing your Java(EE) software applications. Various sensors capture end-to-end information for every request from the end user, to the business tier all the way to the backends. inspectIT is based on an application-centric, business-focused approach, where each technical request is mapped to an application and to a business use case. With inspectIT you always know about the health of your...

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides event collection, normalization and correlation. For more advanced functionality, AlienVault Unified Security Management (USM) builds on OSSIM with these additional capabilities: * Log management * Advanced threat detection with a continuously updated library of pre-built correlation rules * Actionable threat intelligence updates from AlienVault Labs Security Research Team * Rich analytics dashboards and data visualization

PcapsE-OS X is a wrapper of tcpreplay directly integrated on Mac OS X Mavericks 10.9.3 for the execution of caps files that generate simulated malware traffic to test IDS Mac OS X based or redirecting simulated malware traffic on the interface of the IDS to other devices that perform correlation of events. Options:(1) Chat (2) Unix (3) Microsoft (4) Mac OS X (5) Network (6) DHCP (7) Firewalls (8) Routers (9) Proxy (10) Switches (11) HTTP (12) HTTPS (13) DNS (14) SW (15) Nessus (16) Tacacs+ (17) Vmware (18) Backdoors (19) Citrix (20) Mail (21) P2P (22) SQL (23) Web (24) XSS (25) Exploits (26) Xprobe (27) Nmap (28) Telnet (29) SSH (30) FTP (31) Vnc (32) Radius (33) Tor (34) Malware (35) DoS (36) Botnet (37) Openssl (38) Run cap (39) Malware News (40) Updates 2013-2014 pcaps (41) Updates 2015 pcaps.

A complete OpenSource Network Management System Is SNMP-Standard Oriented (tested on Cisco and Linux). It Integrates Syslog, Tacacs, RRDtool (Performance Graphs), Maps, Traps, TFTP, Autodiscovery, Sound Alerts, AAA, Modular and Extensible.

NodeBrain is a rule engine for construction of state and event monitoring applications. It interacts with other monitoring components to perform simple element state monitoring or complex event correlation based on user specified rules. It is extended through the development of node modules (plug-ins) using NodeBrain's C API, and servants (programs written in any language) that interact with the rule engine via stdin, stdout, and stderr. The package includes a small set of plug-in modules to provide capabilities typically required for monitoring applications.

New: Network View... still bugged but I'm working on it Add multiple reference hosts (for futur dump correlation) This tool helps you to easily clean a "pcap" file by manipulating graphically hosts, connections, sessions. Automatically suppress non TCP and non UDP traffic. Can use tshark to decode frames. Can save cleaned capture to pcap file format. See https://sourceforge.net/p/netpackclean/wiki/?source=navbar for Changelog

TL;DR Version: I wrote a tool called GIPC (short for Geographical IP Correlation and pronounced Gypsy) which takes a list of IP address and returns the Geographical information you select based on the MaxMind.com GeoCity Database. The exe requires 2 inputs: The IP file (one IP per line) MaxMind GeoCity database – This can be downloaded HERE:http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz Please read more on my blog: http://jcsocal.blogspot.com/2013/03/geographical-ip-correlation-tool.html

Vigilo is a complete monitoring system designed for large environments thanks to a fully scalable and modular architecture. Built around Nagios, Vigilo integrates metrology graphs, map views, events correlation and reporting.

PortscanGeoinfo is a plugin for the powerful Prelude correlation engine. This plugin correlates alerts from Snort NIDS and OSSEC HIDS sensors regarding portscans. Geographical information (GeoIP) is included in the correlated alert.

OpenESM project to promote software development of enterprise systems management. Focus areas are (Performance and Availability, Configuration Management, Data Warehousing, Reporting and Correlation).

Nariz is a distributed alert correlation system, that performs alarm correlation in two phases, preprocessing locally and distributed postprocessing. By splitting the correlation system amongst several computers.

Canopsis is the first Open Source Hypervisor. It's built on top of existing monitoring solutions (Shinken, Nagios, Syslog)… Its goals is to correlate events from those solutions and fills the gap between technical monitoring and business monitoring.