Ω / LINKS / METADATA ONLY

SIEM and logging.

Reviewed project metadata and official links for red, blue, purple, and cross-team security work.

Evidence reviewed 2026-10-11Bounded seed · not an endorsement or a claim of global completeness

This is a dated, editorially reviewed seed. Links go to upstream projects or vendors. A listing is not authorization, safety certification, legal advice, or a recommendation to deploy a tool. Confirm scope, licensing, current maintenance, and your organization's rules before use.

BLUE TEAM

OpenSearch Security Analytics

OpenSearch-based security analytics, logging, detections, and hunting.

Detection engineering SIEM and logging Threat hunting

Apache-2.0
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

osquery

SQL-like endpoint visibility for inventory, logging, and threat hunting.

Endpoint visibility and EDR SIEM and logging Threat hunting

BSD-style license in the canonical repository.
Reviewed Oct 12, 2026

BLUE TEAM

Security Onion

Security monitoring distribution combining logging, detections, network visibility, and case workflows.

Case management and reporting Detection engineering Network security monitoring SIEM and logging

Elastic License v2 for Security Onion and bundled Elastic components; other components retain their licenses.
Reviewed Oct 12, 2026

BLUE TEAM · CROSS-TEAM

Sigma

Platform-neutral detection rule specification and reviewed rule corpus.

Detection engineering SIEM and logging Threat hunting

Detection Rule License 1.1 for rules; specification and logo are public domain.
Reviewed Oct 12, 2026

BLUE TEAM

Wazuh

Security monitoring, endpoint visibility, logging, and vulnerability management.

Endpoint visibility and EDR SIEM and logging Vulnerability management

GPL-2.0 core with an OpenSSL exception; AGPL-3.0 components also apply.
Reviewed Oct 12, 2026

BLUE TEAM

Zeek

Network telemetry and protocol analysis for monitoring and threat hunting.

Network security monitoring SIEM and logging Threat hunting

BSD license
Reviewed Oct 12, 2026