ndr

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Go client library for Windows MS-RPC and DCOM: DCE/RPC v5, NDR/NDR64, Kerberos/NTLM/SPNEGO, SMB2, and generated stubs for 100+ Windows protocols

Fortinet and Palo Alto logs to VictoriaLogs and Elasticsearch

Advanced Phishing Protection: Suricata rulesets open and free

rpv is a v library for analyzing RPC servers and interfaces on the Windows operating system

Echos is a stealthy C2 traffic emulator built in Rust for Red Teamers. It simulates adversarial beaconing patterns and custom jitter to test EDR/NDR detection logic. Ideal for validating network security signatures in a safe, modular framework.

Command line tool designed to set up, start and maintain Clear NDR installation.

rpv-web is a browser based frontend for the rpv library

A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.

PARE: a computational method to Predict Active Regulatory Elements

A daily updated list of newly registered domains from the past 14 and 30 days for blocking, monitoring and analysis.

A Mikrotik-specific dashboard and network discovery and remediation tool.

Remote Procedure Call libraries (http://pubs.opengroup.org/onlinepubs/9629399/)

Recipes used by stamusctl to create Clear NDR instances.

Reproducible multi-sensor NDR instrument (C++20). Correlates aRGus (ML) + Suricata + Zeek + Wazuh into a Kuzu graph by community_id; characterizes each lens's bias vs labelled ground truth. A forensic record of where ML-for-NIDS actually fails. Research artifact, not production.

eBPF-native Network & Security plateform in a single binary

FlowtraceX Core Platform — a Docker-first Network Detection & Response (NDR) engine for flow-level visibility, real-time detection, and correlation.

A report for your campaign bounces. Reads any sequencer export and says who has to fix it - your list, your domains, your DNS or your copy. Validated on 100k+ real NDRs.

Self-hosted, passive-first network visibility and NDR for IT, IoT and OT: device discovery and inventory, explainable alerts, optional admin-approved response through existing switches and firewalls. Free signed binaries for personal use.

📧 Thunderbird MailExtension that parses bounce/NDR messages and extracts failed recipient addresses to clipboard. Supports DSN headers, RFC822 fallback, full-mailbox scan, deduplication, and a built-in debug log panel.