SOCTools

SOCTools is a collection of tools for collecting, enriching and analysing logs and other security data, threat information sharing and incident handling. It is comprised of the following components:

• Apache Nifi
• Open Distro for Elasticsearch and Kibana
• MISP
• The Hive and Cortex
• Keycloak

SOCTools aims at being easy to install and that all components should be fully integrated so that everything feels like one single application.

Documentation

• Architecture
• Installation
• Data ingestion
• Example use case

License

BSD

Funding

As part of the GÉANT 2020 Framework Partnership Agreement (FPA), the project receives funding from the European Union’s Horizon 2020 research and innovation programme under Grant Agreement No. 856726 (GN4-3).

Developers

• Arne Oslebo
• Bozidar Proevski
• Fredrik Pettai
• Kiril Kjiroski
• Temur Maisuradze
• Vaclav Bartos