|Project Name||Stars||Downloads||Repos Using This||Packages Using This||Most Recent Commit||Total Releases||Latest Release||Open Issues||License||Language|
|Goscript||1,484||5||3 months ago||5||September 12, 2023||3||other||Rust|
|An alternative implementation of Golang specs, written in Rust for embedding or wrapping.|
|Sof Elk||1,368||12 days ago||45||gpl-3.0||Shell|
|Configuration files for the SOF-ELK VM, used in SANS FOR572|
|Tinyrb||442||6 years ago||8||C|
|A tiny subset of Ruby with a Lua'esc VM|
|Como Lang Ng||345||4 years ago||5||gpl-3.0||C|
|como-lang-ng is now ana-lang, located at https://github.com/analang/ana|
|Fancy||258||9 years ago||11||July 30, 2013||5||bsd-3-clause||Fancy|
|Fancy is a dynamic, object-oriented programming language inspired by Smalltalk, Ruby, Io and Erlang that runs on the Rubinius VM.|
|Clanguage||252||1||2 months ago||34||October 12, 2023||18||mit||C#|
|C parser, compiler, and interpreter for .NET|
|Ljtools||208||a year ago||2||gpl-2.0||C++|
|LuaJIT 2.0 bytecode parser, viewer, assembler and test VM. Lua 5.1 parser, IDE and debugger.|
|Cub||195||1||5 years ago||20||October 22, 2018||4||mit||Swift|
|The Cub Programming Language|
|Lioness||155||6 years ago||3||October 09, 2017||10||mit||Swift|
|The Lioness Programming Language|
|Go.sed||120||6 months ago||2||gpl-3.0||Go|
|An implementation of sed in Go. Just because!|
This repository contains the configuration and support files for the SOF-ELK VM Appliance.
SOF-ELK is a big data analytics platform focused on the typical needs of computer forensic investigators/analysts and information security operations personnel. The platform is a customized build of the open source Elastic stack, consisting of the Elasticsearch storage and search engine, Logstash ingest and enrichment system, Kibana dashboard frontend, and Elastic Beats log shipper (specifically filebeat). With a significant amount of customization and ongoing development, SOF-ELK users can avoid the typically long and involved setup process the Elastic stack requires. Instead, they can simply download the pre-built and ready-to-use SOF-ELK virtual appliance that consumes various source data types (numerous log types as well as NetFlow), parsing out the most critical data and visualizing it on several stock dashboards. Advanced users can build visualizations the suit their own investigative or operational requirements, optionally contributing those back to the primary code repository.
The SOF-ELK platform was initially developed for SANS FOR572, Advanced Network Forensics and Analysis, and is now used in several other SANS courses, with additional course integrations being considered. Most importantly, the platform is also distributed as a free and open source resource for the community at large, without a specific course requirement or tie-in required to use it.
More details about the pre-packaged VM are available here: https://for572.com/sof-elk-readme.
main: This branch is considered suitable for widespread use, but should not be used in the FOR572 class itself. The classroom labs are version-locked, but work on this repository is ongoing.
public/*: These branches will be tied to public releases of the VM, allowing version-locked content control after deployment.
class/*: When a VM is prepared for distribution in a SANS course such as FOR572, a new sub-branch will be created under the "class" branch with a name corresponding to the VM version. (e.g. "
develop: This branch contains code that should be functional, but may break at times (and remain broken). Of course, we'll try to avoid that, but it should be clear that this is NOT a branch suitable for "real world" use.
These files are only recommended to be used in the SOF-ELK VM distribution at this time. A great deal of system-level configuration and tie-in is required for them to be used. No support can be provided for the use of these files outside the SOF-ELK VM as distributed via the readme.
/configfiles/: These files conatain parsing/tagging/formatting/etc logic for individual file types as well as output configuration.
/configfiles-UNSUPPORTED/: These configuration files are either not ready for operational use, in testing, or otherwise staged/stashed.
/doc/: Documentation. Always a work in progress.
/grok-patterns/: Custom parsing patterns used by the files in the
/kibana/: These files define the Kibana dashboards and associated files for individual data types. These correspond with the parsing completed by the Logstash files in the
/configfiles/directory, so they probably won't work on your own Logstash instance without some tweaking. To load these to the Kibana interface, run the
/lib/: Supporting files, including elasticsearch mappings, YAML lookup files, and images.
/supporting-scripts/: Numerous scripts and supporting files needed for the SOF-ELK VM to function. Any scripts that may be required for user functionality are symlinked to be in the
All bugs and feature requests should be logged via the github issue tracker: https://github.com/philhagen/sof-elk/issues/.