Search Results for "events"

A cross-platform file change monitor with multiple backends: Apple OS X File System Events API, BSD kqueue, Solaris/Illumos File Events Notification, Linux inotify and a stat()-based backend. fswatch is a file change monitor that receives notifications when the contents of the specified files or directories are modified. fswatch implements four kinds of monitors. A monitor based on the File System Events API of Apple OS X.

...This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.Osquery queries your devices like a database. Osquery uses basic SQL commands to leverage a relational data-model to describe a device. Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

...It aggregates discovered hosts by MAC address, attempts to measure passive RTTs for request/response protocols, maintains per-protocol RTT histories and simple service hints, and can emit structured events and a final table in JSON or CSV formats.

A multi-platform tool for tracking PC/SC events and smart cards states and information. Under Windows, it uses Winscard for PC/SC along with CryptoAPI for retrieving smart card information. Under Linux/MacOSX, it uses pcsc-lite for tracking PC/SC events and it retrieves smart card information by using the file smartcard_list.txt bundled inside the tool and that is provided by the pcsc-tools project.

A versatile gui and console application capable of generating and comparing hashes using a variety of popular hashing libraries.

ZoneMinder is video and cctv surveillance and security application. It supports multiple video or IP cameras and a sophisticated motion detection system based around zones. Both live streams and historic events can be viewed via the web interface.

gwhosin is a Gnome tray notifier informing a user about log-in/out events. The intention for this project is to keep track of authorized users activity and to detect unethical behaviour like reading other users private files.

alerttail tails a file and triggers events based on regex matching. Notify (libnotify), sys command, filtering and geoip localization actions are provided. Highly configurable via config file.

A complex log parser that allows for the scripting of actions, updating databases, on-the-fly configuration and much more. Aggregate logs from disparate systems (i.e. Apache, IPS/IDS and various sensors) and take action on events through external scripts

A dynamic Firewall (using the iptables netfilter) which can alter its is rules on detection of certain attacks/events. Very easily modified and expendable, with mySQL back-end and dynamically loaded user-space filters.