{"id":33013461,"url":"https://github.com/OpenSOC/opensoc","last_synced_at":"2025-11-18T11:03:05.886Z","repository":{"id":17993258,"uuid":"21003348","full_name":"OpenSOC/opensoc","owner":"OpenSOC","description":"OpenSOC Apache Hadoop Code","archived":false,"fork":false,"pushed_at":"2020-02-19T05:37:36.000Z","size":13,"stargazers_count":571,"open_issues_count":1,"forks_count":188,"subscribers_count":176,"default_branch":"master","last_synced_at":"2024-07-25T05:33:44.502Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/OpenSOC.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-06-19T14:31:40.000Z","updated_at":"2024-07-16T02:28:17.000Z","dependencies_parsed_at":"2022-09-04T18:21:39.639Z","dependency_job_id":null,"html_url":"https://github.com/OpenSOC/opensoc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/OpenSOC/opensoc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenSOC%2Fopensoc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenSOC%2Fopensoc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenSOC%2Fopensoc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenSOC%2Fopensoc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/OpenSOC","download_url":"https://codeload.github.com/OpenSOC/opensoc/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/OpenSOC%2Fopensoc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":285051561,"owners_count":27106643,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-11-18T02:00:05.759Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-11-13T17:00:33.179Z","updated_at":"2025-11-18T11:03:05.879Z","avatar_url":"https://github.com/OpenSOC.png","language":null,"readme":"# OpenSOC\n\nOpenSOC integrates a variety of open source big data technologies in order\nto offer a centralized tool for security monitoring and analysis. OpenSOC\nprovides capabilities for log aggregation, full packet capture indexing,\nstorage, advanced behavioral analytics and data enrichment, while applying\nthe most current threat intelligence information to security telemetry\nwithin a single platform.\n\nOpenSOC can be divided into 4 areas:\n\n1. **A mechanism to capture, store, and normalize any type of security\ntelemetry at extremely high rates.**  Because security telemetry is constantly\nbeing generated, it requires a method for ingesting the data at high speeds \nand pushing it to various processing units for advanced computation and analytics.  \n\n2. **Real time processing and application of enrichments** such as threat\nintelligence, geolocation, and DNS information to telemetry being collected.\nThe immediate application of this information to incoming telemetry provides\nthe context and situational awareness, as well as the who and where \ninformation critical for investigation\n\n3. **Efficient information storage** based on how the information will be used:\n\n- Logs and telemetry are stored such that they can be efficiently mined and\nanalyzed for concise security visibility\n- The ability to extract and reconstruct full packets helps an analyst answer \nquestions such as who the true attacker was, what data was leaked, and where \nthat data was sent\n- Long-term storage not only increases visibility over time, but also enables \nadvanced analytics such as machine learning techniques to be used to create \nmodels on the information.  Incoming data can then be scored against these \nstored models for advanced anomaly detection.  \n\n4. **An interface that gives a security investigator a centralized view of data \nand alerts passed through the system.**  OpenSOC’s interface presents alert \nsummaries with threat intelligence and enrichment data specific to that alert \non one single page.  Furthermore, advanced search capabilities and full packet \nextraction tools are presented to the analyst for investigation without the \nneed to pivot into additional tools.   \n\nBig data is a natural fit for powerful security analytics. The OpenSOC\nframework integrates a number of elements from the Hadoop ecosystem to provide\na scalable platform for security analytics, incorporating such functionality as\nfull-packet capture, stream processing, batch processing, real-time search, and\ntelemetry aggregation.  With OpenSOC, our goal is to tie big data into security\nanalytics and drive towards an extensible centralized platform to effectively\nenable rapid detection and rapid response for advanced security threats.  \n\n# Obtaining OpenSOC\n\nThis repository is a collection of submodules for convenience which is regularly\nupdated to point to the latest versions. Github provides multiple ways to obtain\nOpenSOC's code:\n\n1. git clone --recursive https://github.com/OpenSOC/opensoc\n2. [Download ZIP](https://github.com/OpenSOC/opensoc/archive/master.zip)\n3. Clone or download each repository individually\n\nOption 3 is more likely to have the latest code.\n\n","funding_links":[],"categories":["Big Data"],"sub_categories":["Development"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FOpenSOC%2Fopensoc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FOpenSOC%2Fopensoc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FOpenSOC%2Fopensoc/lists"}