Credits
SO-CRATES is built on top of several excellent open-source projects:
| Project | License | Purpose |
|---|---|---|
| Suricata | GPLv2 | Network traffic analysis and IDS |
| Zircolite | LGPLv3 | Sigma rule detection for log files |
| YARA | BSD-3-Clause | Malware pattern matching |
| SigmaHQ Rules | Detection Rule License (DRL) 1.1 | Detection logic for log analysis |
| YARA Forge | Various | Curated YARA rules |
| Security Onion Playbooks | Custom | Investigation guidance for Suricata/Sigma alerts |
| Security Onion AI Summaries | Custom | AI-generated rule summaries for Suricata/Sigma/YARA alerts |
| Emerging Threats Open | MIT | Suricata network rules (default) |
| Suricata Traffic ID | MIT | Suricata network rules (optional) |
| Abuse.ch SSL Blacklist | CC0-1.0 | Suricata network rules (optional) |
| Abuse.ch JA3 Fingerprints | CC0-1.0 | Suricata network rules (optional) |
| Abuse.ch Feodo Tracker | CC0-1.0 | Suricata network rules (optional) |
| Abuse.ch URLhaus | CC0-1.0 | Suricata network rules (optional) |
| Etnetera Aggressive IP Blacklist | MIT | Suricata network rules (optional) |
| Positive Technologies PT Rules (Open) | Custom | Suricata network rules (optional) |
| PAW Patrules | CC-BY-SA-4.0 | Suricata network rules (optional) |
| IPFire DBL | CC-BY-SA-4.0 | Suricata network rules (optional) |
| Stamus Lateral Movement | GPL-3.0-only | Suricata network rules (optional) |
| Threat Hunting Rules (tgreen) | GPLv3 | Suricata network rules (optional) |
| NMAP Scan Detection | MIT | Suricata network rules (optional) |
| Antiphishing | GPL-3.0 | Suricata network rules (optional) |
| The Hunter's Ledger | CC-BY-4.0 | Suricata network rules (optional) |
| D3 | ISC | Sankey diagram visualization |
| d3-sankey | BSD-3-Clause | Sankey diagram layout |
| tcpdump | BSD-3-Clause | Stream/hexdump carving |
| Wireshark/tshark | GPLv2 | ASCII transcript extraction |
| ExifTool | Perl Artistic License / GPL | EXIF/media metadata extraction |
| file | BSD-2-Clause-alike | MIME/file-type detection |