AiSOC delivers an open-source AI Security Operations Center that unifies event ingestion, graph correlation, autonomous triage, and purple-team adversary emulation into a single self-hosted console. Security analysts triage alerts across an interactive Investigation Rail that visualizes six-event attack timelines, pivot-path entity graphs, and recommended containment steps. The underlying LangGraph agentic engine reasons over ingested telemetry, querying MITRE ATT&CK frameworks, CISA Known Exploited Vulnerabilities catalogs, and Shodan intelligence while recording every prompt, tool execution, and evidentiary citation in an immutable Investigation Ledger. Incident responders execute automated containment playbooks, including host network isolation, credential revocation in identity providers, and firewall blocklist updates with human-in-the-loop sign-offs. Threat hunters input plain-English hypotheses into the natural-language hunt workbench to generate and execute ES|QL, SPL, and KQL queries against historical telemetry stores. Platform operators connect over seventy vendor connectors spanning CrowdStrike, SentinelOne, Microsoft Defender, AWS Security Hub, Okta, and Cloudflare to normalize streaming events into Open Cybersecurity Schema Framework standards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Enterprise security stacks assume an enterprise budget; Wildbox assumes a server you already own. It runs your whole security operation as a set of cooperating services behind a single HTTPS gateway: threat intelligence collectors pull indicators from seven public feeds on a schedule, starting with abuse.ch's Feodo Tracker, and every indicator is searchable in one place. Fifty-two security tools sit behind one API, covering DNS, TLS, email security, headers, and port analysis. The cloud posture service runs 22 configuration checks against your live AWS accounts and keeps each scan's report, while the vulnerability service inventories your assets, prioritizes findings by risk, and tracks them through remediation with SLA checks and alert rules. When something needs doing, YAML playbooks execute response workflows as background jobs, and the agents service writes Claude-generated threat-enrichment reports for suspicious indicators when you give it an API key. An osquery-based sensor streams endpoint telemetry from your hosts into the platform, kept separate per team. Users, teams, roles, and scoped API keys live in the identity service, and the backends accept nothing that did not arrive through the gateway, so your security data never leaves hardware you control. Optional Compose profiles add n8n automation and Prometheus monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Protecting over 10,000 organizations worldwide with 16,000+ GitHub stars, Wazuh delivers enterprise-grade security operations through a fully open-source platform with zero feature gating. The unified XDR and SIEM solution deploys lightweight agents across Linux, Windows, macOS, Solaris, AIX, and HP-UX endpoints that stream security telemetry to a centralized cluster built on OpenSearch for indexing and the Wazuh Dashboard for visualization and management. Core capabilities include real-time file integrity monitoring with inotify-based detection and who-data attribution, automated vulnerability assessment that correlates software inventories against continuously updated CVE databases, Security Configuration Assessment against CIS benchmarks, rootkit detection, and log data analysis with a rules engine supporting over 3,000 built-in detection rules mapped to MITRE ATT&CK tactics and techniques. Wazuh monitors cloud infrastructure at the API level with native modules for AWS, Azure, and Google Cloud, detects container anomalies through Docker engine integration, and ingests third-party telemetry via syslog and REST APIs from sources like VirusTotal, TheHive, YARA, Suricata, and PagerDuty. Pre-built compliance dashboards and reports cover PCI DSS, HIPAA, NIST 800-53, GDPR, and TSC frameworks. Active response capabilities automatically trigger countermeasures including firewall rule updates, account lockouts, and endpoint isolation when threats are detected. The platform scales horizontally with multi-node clustering for high availability. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-2.0 licensed.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Point it at your cloud accounts and it returns a ranked list of what is misconfigured, mapped to the standards auditors ask about. Connect providers like AWS, Azure, Google Cloud, Kubernetes, Microsoft 365, and GitHub, launch a scan or schedule recurring ones, and read the results on an overview with a ThreatScore gauge, severity bars, and a resource inventory by category. The Findings page groups failed checks, expands each group into the affected resources, and lets teams mute noise, triage status, send groups to Jira, and create alerts that email or message people after each scan. Compliance pages score every framework from CIS and NIST to PCI DSS, SOC 2, HIPAA, GDPR, and ISO 27001, with a watchlist for the ones you care about and downloadable reports. Attack Paths draws a graph from IAM roles and policies to outcomes like code execution, using a Neo4j graph database filled by AWS scans. A built-in AI assistant answers questions about critical findings and compliance gaps with the model provider you configure. Organizations, roles, and API keys keep access tidy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Security scanners each report in their own format, and DefectDojo is the self-hosted platform that imports those reports and keeps a single, triaged list of findings. Reports in mixed formats? More than 350 built-in parsers read output from Burp Suite, ZAP, Trivy, Tenable Nessus, SonarQube, Snyk, and Checkmarx, and Generic Findings Import covers tools without a parser through CSV or JSON files. The same scan every night? Reimport adds new findings, can close the ones that vanished, and reopens the ones that return, while deduplication ties repeat detections inside an asset to their original. Decisions already made? False positive, out of scope, and risk accepted statuses survive reimport, so nobody triages the same noise twice. A deadline on every fix? Severity-based SLA countdowns flag breaches and can notify the users assigned to each asset, and full risk acceptances carry notes, files, and an expiry date that returns findings to active by default. Many teams, many applications? Organizations, assets, engagements, and tests mirror how security work is organized, with permissions that cascade downward. Pipelines that should report themselves? The REST API and CI/CD engagements import results automatically, and findings push to Jira as tickets. Someone outside security wants a summary? Dashboards track metrics, and a widget-based report builder produces HTML reports that print to PDF. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

MISP is an open source threat intelligence platform where analysts log indicators and incidents, see how they connect, and share them with trusted organizations. Each case is an event holding attributes and structured objects such as files, network connections, and email messages, with Markdown reports beside the machine-readable data. A correlation engine links events that share values, including fuzzy-hash and CIDR matches, and warning lists flag benign values before they cause false positives. Taxonomies and galaxies tag events with TLP levels, threat actors, malware families, and MITRE ATT&CK techniques. Analysts explore relationships in an event graph and a correlation graph with a timeline, and build drag-and-drop dashboards with maps and ATT&CK heatmaps. Sharing groups control who sees which event, and instances synchronize with partner organizations with distribution settings down to a single attribute. Free-text, URL, bulk, and STIX imports fill the database, and exports reach Suricata, Snort, Zeek, OpenIOC, CSV, STIX 1 and 2, and RPZ zones. A REST API, the PyMISP library, expansion modules, and workflows enrich data and automate publishing. ZeroMQ and Kafka streams announce every change to connected tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Hunting for a suspicious file, process, or registry key across every endpoint becomes a single hunt in Velociraptor, an endpoint visibility and digital forensics platform. A web console sends tasks to clients on Windows, Linux, and macOS machines, which hold a persistent connection and run each task as soon as it is issued. A hunt runs a VQL artifact, one of more than 400 built in, across selected endpoints, picks up machines that reconnect later, and tracks which hosts have answered. Each hunt and collection opens into a notebook where markdown and live VQL cells group, filter, and timeline the results. A virtual file system browses a client's directories and fetches files through file, NTFS, and registry accessors, with hex and text viewers. Offline collectors bundle chosen artifacts into one binary that writes an optionally encrypted container for later import, suiting machines that never reach the server. Client event queries stream telemetry such as DNS lookups to the server, and server event queries can alert Slack, email, Elastic, or Splunk. Quarantine confines a host's network traffic to the Velociraptor server, and the Shell page runs commands on it. Sign-in works through Google, Azure, GitHub, OIDC, or SAML, with reader, analyst, investigator, and administrator roles. Responders reach for it during threat hunts, compromised host triage with KapeFiles targets, and dead disk image analysis. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Trusted by over 60,000 organizations worldwide with more than 8,100 GitHub stars since 2010, Graylog has established itself as one of the fastest paths from raw log data to operational visibility, delivering centralized log management, security analytics, and compliance auditing through a purpose-built web interface with sub-second search at scale. The platform ingests logs from virtually any source via syslog, GELF, Beats, raw TCP/UDP, HTTP, CEF, IPFIX, and Netflow protocols, processing each message through configurable pipelines that parse fields, apply transformations, enrich events with GeoIP data from MaxMind or IPinfo lookup tables, and route messages to appropriate streams based on content rules. OpenSearch handles full-text indexing and storage with dynamic shard sizing that automatically calculates appropriate sizes from available node memory, while MongoDB stores configuration metadata including user accounts, roles, dashboards, alert rules, and pipeline definitions. The alerting system integrates with Slack, PagerDuty, and email with customizable notification templates and Replay Search links for immediate investigation context. Version 7.0 introduced MCP server integration for connecting preferred LLMs to perform AI-assisted log analysis and automation, while version 7.1 added Sigma detection rule import from private GitHub, GitLab, and Bitbucket repositories for detection-as-code workflows. The Sidecar agent management system centrally configures and deploys Filebeat, Winlogbeat, and nxlog collectors across infrastructure from the Graylog web interface. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. SSPL licensed.

Security teams drown in alerts that all demand the same twelve manual steps. Shuffle is an open-source security orchestration, automation, and response platform that turns those steps into visual workflows: an alert arrives from the SIEM, Shuffle enriches it against threat intelligence, opens the ticket, isolates the host, and messages the analyst, without anyone copying values between browser tabs. Analysts assemble workflows on a canvas from more than two thousand pre-built app integrations covering email, EDR, firewalls, ticketing, chat, and cloud services, and any tool with an OpenAPI description can be converted into a new app automatically, exported again, and reused outside Shuffle. Webhooks, schedules, and pipeline triggers start executions; custom Python covers the odd cases; conditional branches and sub-workflows keep one big playbook from becoming spaghetti. Multi-tenancy with sub-organisations, roles, single sign-on, and MFA fits managed security providers running one deployment for many customers, and execution workers can run on premises closer to the systems they touch. Community members publish workflows and apps to a marketplace, so a phishing triage playbook that works for one SOC can be running in another by lunchtime. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Agentic SOC Platform compresses hours of manual security analysis into seconds by deploying specialized AI agents that autonomously triage, investigate, and enrich security alerts. The Python/Django backend processes SIEM webhooks through Redis Streams into a modular pipeline where LangGraph-orchestrated agents extract IOCs, correlate signals, and generate Cases with severity, confidence, impact, priority, and structured verdicts. The built-in SIRP provides full case management with Alerts, Artifacts, Enrichments, Tickets, and a Knowledge base that accumulates institutional memory for both human analysts and LLM agents. Native Splunk and Elasticsearch/Kibana integrations deliver unified log search through a standardized interface so agents and analysts share identical security context. The playbook engine combines traditional SOAR automation with AI-powered investigation — launching threat hunting agents, knowledge extraction, threat intelligence enrichment, and CMDB lookups from a single orchestration layer. MCP Plugin support exposes ASP capabilities to Claude Code, Codex, and OpenCode, enabling external AI agents to operate cases, search logs, query threat intelligence, and write custom modules directly. Python Modules adapt new alert sources while Playbooks orchestrate LLM analysis and automated response actions, scaling the platform with your security scenarios. Deploy via Docker Compose with all data staying inside your network. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

OpenSearch is a search and analytics platforms, powering full-text search, log analytics, observability, and AI-powered vector retrieval at petabyte scale. The distributed engine provides BM25 full-text search alongside k-NN vector search using NMSLIB, Faiss, and Lucene libraries, enabling semantic search, hybrid search combining keyword and vector scoring through normalization processors, neural sparse search, and retrieval-augmented generation workflows with built-in ML Commons for model hosting. OpenSearch Dashboards delivers interactive visualization with Discover for log exploration, custom dashboards, alerting, anomaly detection using Random Cut Forest algorithms, and Security Analytics with detection rules mapped to MITRE ATT&CK. Native Prometheus integration with full PromQL support unifies metrics alongside logs and traces in a single observability interface, while Data Prepper handles telemetry ingestion from OpenTelemetry collectors, Fluent Bit, and Logstash-compatible pipelines. SQL and Piped Processing Language queries with a visual PPL builder enable analysts to query data without learning the native DSL. Index State Management automates index lifecycle with rollover, shrink, and delete policies, while cross-cluster replication and searchable snapshots on S3-compatible storage provide disaster recovery. Scoped API keys, field-level security, document-level security, and audit logging deliver enterprise-grade access control. Docker Compose deploys multi-node clusters alongside the Kubernetes operator for orchestrated production environments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

SpiderFoot is an open-source OSINT automation platform, replacing hours of manual reconnaissance with automated intelligence gathering across more than 200 data collection modules. The platform accepts ten distinct target types including IP addresses, domains, hostnames, network subnets, ASNs, email addresses, phone numbers, usernames, person names, and Bitcoin addresses, then feeds them through a publisher-subscriber event bus where each module's findings trigger downstream analysis automatically. SpiderFoot queries Shodan, VirusTotal, HaveIBeenPwned, AlienVault OTX, Censys, crt.sh, WHOIS databases, social media platforms, breach databases, and dozens more sources, with most modules requiring no API keys and many offering free tiers for those that do. The YAML-configurable correlation engine applies 37 pre-defined rules to identify relationships between discovered data points, flagging patterns like shared infrastructure, credential exposure, and domain reputation anomalies. Results export in CSV, JSON, and GEXF graph formats for integration with external analysis tools. TOR integration enables dark web searching, and SpiderFoot can invoke external tools including DNSTwist, Whatweb, Nmap, and CMSeeK for deeper technical assessment. The embedded web server delivers an intuitive dashboard for scan management, data visualization, and result exploration alongside a full command-line interface for scripted automation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Preloop is a self-hostable control plane that governs every AI agent tool call and model call, and can run ticket-triggered agent work that returns as reviewable pull requests. An MCP firewall can allow, deny, or hold any tool call for approval, with require-justification rules written as YAML and CEL policy. Human approvals arrive on mobile, watch, Slack, Mattermost, email, webhook, or the command line, and agents can ask a person a question before continuing. The model gateway speaks OpenAI, Anthropic, and Gemini formats, applies budgets and allowed-model lists, and attributes token spend by model, agent, session, API key, flow, and user. Flows start agents from GitHub, GitLab, Bitbucket Cloud, Jira, webhooks, or CI jobs, in hosted containers or on private runners that connect over an outbound WebSocket. Twenty-one presets review pull requests, implement issues, triage tickets, scan for vulnerabilities, and collect evidence packs. Operators can steer a running agent from the console, phone, or watch with notes, then review the resulting pull request. One session timeline records tool calls, model calls, policy decisions, approvals, spend, outcomes, and synchronized recordings. Fleet Map shows people, devices, agents, models, and observed work in one view. An account kill switch blocks gateway and tool traffic and stops managed runs, with audited recovery. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Put a checkpoint in front of every tool call your AI agents make, so a poisoned web page or file cannot quietly move money or send private data. Each call is classified and policy-checked before it executes, then allowed, blocked, or held for a person. Held calls land in an approvals queue that shows what the user asked, which passage the agent read, and the exact recipient or amount in question, with one-click block or allow. Instruction provenance flags destinations that appeared only in untrusted content, like an IBAN hidden in a file. The cockpit lists every run as a timeline of steps with verdicts, groups violations by the protection that caught them, and scores ten attack surfaces on a Security 360 page. An agent registry tracks owners, scope, and call counts. Budgets, anomaly alerts, and a kill switch cap runaway behavior. Sensitive values are redacted from traces, signed receipts prove a call was allowed, and exports produce PDF and CSV audit evidence. Python and TypeScript SDKs plug in with one line, or an LLM proxy catches calls with an environment variable. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.