ndr

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

Go client library for Windows MS-RPC and DCOM: DCE/RPC v5, NDR/NDR64, Kerberos/NTLM/SPNEGO, SMB2, and generated stubs for 100+ Windows protocols

Fortinet and Palo Alto logs to VictoriaLogs and Elasticsearch

rpv is a v library for analyzing RPC servers and interfaces on the Windows operating system

Advanced Phishing Protection: Suricata rulesets open and free

Command line tool designed to set up, start and maintain Clear NDR installation.

Echos is a stealthy C2 traffic emulator built in Rust for Red Teamers. It simulates adversarial beaconing patterns and custom jitter to test EDR/NDR detection logic. Ideal for validating network security signatures in a safe, modular framework.

rpv-web is a browser based frontend for the rpv library

A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.

PARE: a computational method to Predict Active Regulatory Elements

A daily updated list of newly registered domains from the past 14 and 30 days for blocking, monitoring and analysis.

Remote Procedure Call libraries (http://pubs.opengroup.org/onlinepubs/9629399/)

Recipes used by stamusctl to create Clear NDR instances.

A Mikrotik-specific dashboard and network discovery and remediation tool.

Reproducible multi-sensor NDR instrument (C++20). Correlates aRGus (ML) + Suricata + Zeek + Wazuh into a Kuzu graph by community_id; characterizes each lens's bias vs labelled ground truth. A forensic record of where ML-for-NIDS actually fails. Research artifact, not production.

eBPF-native Network & Security plateform in a single binary

FlowtraceX Core Platform — a Docker-first Network Detection & Response (NDR) engine for flow-level visibility, real-time detection, and correlation.

📧 Thunderbird MailExtension that parses bounce/NDR messages and extracts failed recipient addresses to clipboard. Supports DSN headers, RFC822 fallback, full-mailbox scan, deduplication, and a built-in debug log panel.

A full-stack PCAP replay and network traffic testing platform for IDS/NDR validation and security research.

AI-powered Security Operations Center (SOC) with machine learning-driven threat detection, Network Detection & Response (NDR), automated remediation, and self-healing cybersecurity workflows.