Vigil is an open-source AI SOC (Security Operations Center) platform that orchestrates autonomous threat hunting, incident response, and case management through a multi-agent architecture. The system ingests security findings from SIEMs (Splunk, Elastic, Azure Sentinel), EDRs (CrowdStrike, Microsoft Defender), and other sources via Kafka or webhooks, then uses LLM-driven agents (hunt, root_cause, adjudicate, investigate, compose, chat) to analyze, enrich, and respond. A TypeScript agent layer with event-sourced ledgers and budget enforcement runs investigations, while a Python daemon handles polling, deduplication, and orchestration. The platform exposes its own tools via MCP (Model Context Protocol) and integrates with 30+ external security tools through a descriptor-based plugin system. The frontend is a React SPA with a setup wizard, dashboards, and case management UI. Deployment is via Docker Compose or Helm, with PostgreSQL, Redis, and optional Kafka as backing services.
RVX is a fully functional RISC-V RV32I microcontroller IP core written in synthesizable Verilog, targeting FPGAs (specifically Digilent Arty A7 and Cmod A7 boards). It implements the RV32I base ISA v2.1 plus the Zicsr extension and Machine-Level ISA v1.13. The core includes a custom system bus (`rvx_bus`) that can be parameterized with an arbitrary number of memory-mapped slaves, and a set of peripherals: UART, GPIO, SPI, and machine timer (`mtime`/`mtimecmp`). The repository provides complete example projects for bare-metal and FreeRTOS, including board-specific wrapper modules, constraint files, and TCL scripts for Vivado project creation. The software examples use CMake with the RISC-V GCC toolchain and the `libsteel` hardware abstraction library. A comprehensive verification suite covers all RV32I instructions via RISC-V Architecture Test programs, alongside Cocotb-based peripheral tests and a Verilator simulation framework with C++ harness. The bus interface uses a simple request/response handshake with write strobes, which is clean but non-standard (not AXI/Wishbone). The core is a single-monolithic file (~1300 lines) with a 4-state FSM and no pipelining, making it compact but harder to modify. Overall, the repository is a well-documented, professionally structured open-source hardware project with strong testing practices, suitable for FPGA-based embedded systems education or low-complexity control applications.
This repository is the infrastructure-as-code backbone for Security Onion, a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management. It contains over 1,700 files of SaltStack states, Jinja templates, shell scripts, and Python modules that orchestrate the deployment, configuration, and lifecycle management of a distributed grid of security monitoring nodes. The code manages the entire Elastic Stack (Elasticsearch, Logstash, Kibana), network sensors (Zeek, Suricata), file analysis (Strelka), endpoint monitoring (Elastic Fleet/Agent), authentication (Kratos/Hydra), messaging (Kafka/Redis), metrics (Telegraf/InfluxDB), and the Security Onion Console (SOC) web UI. It is not a standalone application but a deployment and configuration system that transforms a bare OS into a fully operational security operations center. The repository is actively maintained with frequent commits, versioned releases, and a large community. Key architecture patterns include role-based state inclusion via `allowed_states`, consistent Docker container management, Jinja-based configuration merging, and event-driven reactors for rule pushes. Notable reusable components include a self-contained threat intelligence analyzer framework, a YAML manipulation CLI tool, and polling-based beacons that avoid inotify leaks.
This repository provides board support packages for the LiteX open-source FPGA SoC builder. It contains over 150 platform definitions (pinouts, connectors, toolchain setup) and corresponding target scripts that assemble a complete SoC (CPU, memory, peripherals) for each FPGA board. The architecture is a collection of Python modules organized into `litex_boards/platforms/` and `litex_boards/targets/`, with each target being a standalone script that can be invoked via `python -m litex_boards.targets.<board> --build --load`. The system supports a wide range of FPGA families (Xilinx, Lattice, Intel/Altera, Gowin, Efinix, CologneChip) and integrates with the broader LiteX ecosystem (LiteDRAM, LiteEth, LitePCIe, etc.) for memory controllers, networking, and high-speed interfaces. Key entry points are the `main()` functions in each target file, which use `LiteXArgumentParser` for CLI argument handling and `Builder` for bitstream generation. The repository is community-maintained under litex-hub and includes CI scripts for consistency checks, board inventory generation, and regression tests.