Security Monitoring Tools logopeterindia.net
Knowledge Hub

Security Monitoring Tools

Tools that collect endpoint, log and network telemetry for detection and investigation, from Sysmon and the Elastic Stack to Velociraptor.

21 topics•4 categories•Updated November 2026

Endpoint Telemetry & Investigation

5 entries

See what runs on endpoints and investigate it at scale.

01SysmonWindows endpoint telemetry. A Sysinternals system service and driver that logs process creation, network connections, file changes and more to the Windows event log, with rules set by a configuration file. 02VelociraptorEndpoint visibility and investigation. Open-source tool for collecting and hunting artifacts across many endpoints using its query language (VQL), used in digital forensics and incident response. 03osqueryExposes operating-system data as SQL tables so you can query processes, users, packages and network state on Windows, macOS and Linux. 04WazuhFree open-source platform combining XDR and SIEM capabilities, with agents for log collection, file integrity monitoring, vulnerability detection and active response. 05FalcoCNCF runtime security project that watches system calls on hosts and containers and alerts on suspicious behavior using rules.

Log Analysis & Processing

6 entries

Collect, parse, search and visualize security logs.

06KibanaSearch, dashboard and visualization front end for Elasticsearch, used for log exploration, security detections and investigation in the Elastic Stack. 07LogstashLog analysis and processing. Server-side data pipeline that ingests logs from many sources, parses and transforms them, and ships them to Elasticsearch or other outputs. 08ElasticsearchDistributed search and analytics engine that stores and indexes log and event data for fast querying. 09GraylogLog management platform for centralizing, searching and alerting on log data, with security-focused editions. 10SplunkCommercial platform for searching, monitoring and analyzing machine data, widely used as a SIEM. 11Grafana LokiHorizontally scalable log aggregation system that indexes labels rather than full text, and works with Grafana dashboards.

Network Security Monitoring

3 entries

Watch traffic for attacks and unusual behavior.

12ZeekNetwork analysis framework that turns traffic into structured logs for connections, DNS, HTTP, TLS and more, useful for hunting and forensics. 13SuricataOpen-source network threat detection engine providing intrusion detection and prevention, network security monitoring and file extraction. 14Security OnionFree open-source Linux distribution for threat hunting, network security monitoring and log management, bundling tools such as Suricata and Zeek.

Related Pages

7 entries

Related directories on this site.

15SIEM SoftwareSecurity information and event management platforms. 16XDR SoftwareExtended detection and response platforms. 17AI-powered Log Analytics ToolsLog analytics with AI assistance. 18Observability ToolsMetrics, logs and traces tools. 19Incident Management ToolsTools for handling incidents. 20Network Discovery & Mapping ToolsNmap, Nuclei, Shodan and related tools. 21CybersecurityHub of cybersecurity directories: SIEM, XDR, zero trust, cloud, application and AI security.

Frequently Asked Questions

What are security monitoring tools?

Tools that collect and analyze telemetry from endpoints, networks and applications to detect suspicious activity and support investigation and response.

What is Sysmon?

Sysmon is a Microsoft Sysinternals service that records detailed Windows events such as process creation, network connections and file changes. Teams forward these events to a SIEM or log platform for detection.

What do Kibana and Logstash do?

Logstash ingests, parses and transforms logs into a pipeline. Kibana searches and visualizes the data stored in Elasticsearch. Together with Elasticsearch they form the Elastic Stack.

What is Velociraptor used for?

Velociraptor collects forensic artifacts and runs hunts across many endpoints using its query language, giving responders visibility during investigations.

How do these tools work together?

A common setup uses Sysmon on Windows hosts, Logstash or agents to ship events, Elasticsearch and Kibana for search and dashboards, and Velociraptor to dig into endpoints when an alert needs investigation.

What is the difference between a SIEM and these tools?

A SIEM centralizes logs, correlates events and raises alerts. Many tools here feed a SIEM or provide parts of one. See the SIEM Software page on this site.

Which tools are open source?

Sysmon is free but closed-source. Velociraptor, osquery, Wazuh, Falco, Logstash, Kibana, Graylog's open edition, Loki, Zeek, Suricata and Security Onion have open-source or source-available components, so check each project's current license.

How were these tools chosen?

The page lists widely used tools across endpoint telemetry, log processing and network monitoring. Descriptions summarize each project's own documentation, so verify current features and licensing on the vendor site.