Vigil is an open-source AI SOC (Security Operations Center) platform that orchestrates autonomous threat hunting, incident response, and case management through a multi-agent architecture. The system ingests security findings from SIEMs (Splunk, Elastic, Azure Sentinel), EDRs (CrowdStrike, Microsoft Defender), and other sources via Kafka or webhooks, then uses LLM-driven agents (hunt, root_cause, adjudicate, investigate, compose, chat) to analyze, enrich, and respond. A TypeScript agent layer with event-sourced ledgers and budget enforcement runs investigations, while a Python daemon handles polling, deduplication, and orchestration. The platform exposes its own tools via MCP (Model Context Protocol) and integrates with 30+ external security tools through a descriptor-based plugin system. The frontend is a React SPA with a setup wizard, dashboards, and case management UI. Deployment is via Docker Compose or Helm, with PostgreSQL, Redis, and optional Kafka as backing services.
VictoriaLogs is a high-performance, lightweight log management system designed for both small and large-scale deployments. It consists of multiple Go-based services for log ingestion (vlagent, vlinsert), storage (vlstorage), and querying (vlselect), complemented by a Preact/TypeScript web UI (vmui). The system uses a columnar storage approach with bloom filters, custom encoding, and a pipeline-based query engine (LogsQL) for efficient log processing. Key architectural patterns include composable data transformation pipes, extensible filter systems, mergeable statistical aggregations, and object pooling for performance optimization. The frontend features a modular component architecture with custom hooks for state management, contextual controls, and interactive visualizations.
OpenUBA is a full-stack User and Entity Behavior Analytics (UEBA) platform for security anomaly detection, investigation, and response. It provides a complete lifecycle for ML models (install, train, infer, version, share) via a pluggable registry supporting OpenUBA Hub, GitHub, HuggingFace, and local filesystem. The platform includes a rule engine with a visual DAG-based builder (ReactFlow), case management, real-time dashboards, multi-backend visualization (matplotlib, plotly, bokeh, etc.), and an LLM-powered assistant. The backend is built on FastAPI with PostgreSQL, SQLAlchemy, JWT/RBAC authentication, and optional Spark/Elasticsearch integrations. The frontend uses Next.js 14 (App Router), Apollo Client (GraphQL), shadcn/ui, and Recharts. A Python SDK enables programmatic access to all features. The system runs on Kubernetes with a Kopf operator managing custom resources (UBATraining, UBAInference, UBAWorkspace, UBAPipeline) for containerized model execution in isolated Docker images per ML framework (sklearn, PyTorch, TensorFlow, NetworkX). While primarily an application, it includes research-oriented components like experiment tracking, feature store, and Jupyter notebook workspaces, making it a hybrid tool for both security operations and data science workflows.
This repository is a curated 'awesome list' of public security-related APIs, not a software application or data pipeline. The primary artifact is README.md, a hand-maintained table of roughly 100 APIs categorized into Online services, Tools, SIEM platforms, and Various. Each entry records the API name, description, authentication type, HTTPS support, documentation link, and licensing model. The only executable logic is a GitHub Actions workflow that runs awesome_bot weekly to detect broken links in the README. A supplementary document, apidocs/haveIBeenPwned.md, documents unofficial Have I Been Pwned domain-search endpoints discovered in 2018. Despite being classified as an application for tooling purposes, there is no application code, library, or service in this repository. It functions as a knowledge base for security engineers and threat intelligence practitioners. The CI workflow is the only automated component and is a standard awesome-list link checker. The value is in the curation and categorization of APIs, not in reusable software components. The list is actively maintained, but some entries are aging and may reflect outdated API details or vendor changes.