{
 "schemaVersion": 1,
 "generated": "2026-10-30",
 "dataLicense": "CC BY-SA 4.0",
 "license": "CC BY-SA 4.0",
 "notice": "Data from Open Source Everything (https://opensourceeverything.org), licensed CC BY-SA 4.0: use it freely, credit the site, link to the page, and share changes under the same license. Listings were drafted with AI assistance and are managed by the r/TrueOpenSource moderators; check a project's own page before relying on a fact.",
 "id": "security-monitoring",
 "name": "Intrusion detection and security monitoring",
 "page": "https://opensourceeverything.org/g/security-monitoring/",
 "category": "selfhost",
 "categoryName": "Home servers & security",
 "job": "Spotting attacks and suspicious activity on servers and computers",
 "closedApps": [
  "Splunk",
  "CrowdStrike Falcon",
  "SentinelOne"
 ],
 "coverage": "one-full",
 "alternatives": [
  {
   "id": "crowdsec",
   "name": "CrowdSec",
   "page": "https://opensourceeverything.org/p/crowdsec/",
   "summary": "CrowdSec is a security program that watches server logs and web traffic for attacks, then blocks the attacking internet addresses. It also shares blocked addresses with a community blocklist so other users are protected too. It is aimed at system administrators and IT teams who run servers or websites.",
   "kind": "self_hosted",
   "setup": "advanced",
   "setupWhy": "You run it on your own server (a computer you set up and keep running), or from the command line.",
   "platforms": [
    "windows",
    "server"
   ],
   "license": "MIT",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 15349,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/crowdsecurity/crowdsec",
   "website": "https://www.crowdsec.net",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "crowdsec",
   "rank": 1,
   "fit": "full",
   "note": null,
   "why": "Does the whole job · Advanced setup",
   "score": 64.6
  },
  {
   "id": "suricata",
   "name": "Suricata",
   "page": "https://opensourceeverything.org/p/suricata/",
   "summary": "Suricata is a program that watches network traffic and flags possible attacks or suspicious activity. It is aimed at security teams and IT staff who protect networks and servers.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "linux"
   ],
   "license": "GPL-2.0",
   "licenseClass": "open",
   "licenseNeedsCheck": false,
   "stars": 6783,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/OISF/suricata",
   "website": "https://suricata.io",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "suricata",
   "rank": 2,
   "fit": "partial",
   "note": "Detects network attacks; no mention of watching individual computers or a hosted dashboard.",
   "why": "Does part of the job · Advanced setup",
   "score": 34.5
  },
  {
   "id": "velociraptor",
   "name": "Velociraptor",
   "page": "https://opensourceeverything.org/p/velociraptor/",
   "summary": "Velociraptor is a tool that collects detailed information from computers and servers to help investigators see what is happening on them. It is aimed at security staff, incident responders and IT administrators.",
   "kind": "developer_tool",
   "setup": "advanced",
   "setupWhy": "Made for developers: you use it from code or the command line.",
   "platforms": [
    "windows",
    "mac",
    "linux"
   ],
   "license": "AGPL-3.0-only",
   "licenseClass": "open",
   "licenseNeedsCheck": true,
   "stars": 4384,
   "forks": null,
   "status": "active",
   "verified": false,
   "latestRelease": null,
   "code": "https://github.com/Velocidex/velociraptor",
   "website": "https://docs.velociraptor.app",
   "download": null,
   "release": null,
   "family": null,
   "familyChildren": [],
   "howToHelp": null,
   "project": "velociraptor",
   "rank": 3,
   "fit": "partial",
   "note": "Collects endpoint data for investigation; no stated live attack alerting.",
   "why": "Does part of the job · Advanced setup",
   "score": 30.9
  }
 ],
 "source": "https://opensourceeverything.org/g/security-monitoring/",
 "group": "Intrusion detection and security monitoring",
 "replaces": [
  "Splunk",
  "CrowdStrike Falcon",
  "SentinelOne"
 ]
}