Skip to content
MozDef: Mozilla Enterprise Defense Platform
Python JavaScript HTML CSS Shell Dockerfile Makefile
Branch: master
Clone or download
pwnbus Merge pull request #1453 from mozilla/fix-geomodel-doc
Mark the Geomodel v0.1 spec as :orphan: so the doc builder doesn't emit a warning
Latest commit 9ec98b8 Sep 13, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
alerts Create locality state entries with the correct type name Sep 12, 2019
bot Replace http with https in docs Aug 1, 2019
cloudy_mozdef Readd "Merge pull request #1436 from mozilla/revert-1420-alerts_mongo… Sep 4, 2019
docker Merge branch 'geomodel-v-0-1' of into geomo… Sep 10, 2019
docs Mark the Geomodel v0.1 spec as :orphan: so the doc builder doesn't em… Sep 13, 2019
loginput Update MPL license to https Aug 1, 2019
meteor Merge pull request #1434 from mozilla/veris_tag_update Sep 5, 2019
mozdef_util Update MPL license to https Aug 1, 2019
mq Fixup uptycs cron script and add to lower keys plugin Sep 5, 2019
rest Ensure modifiedat is jsonable Sep 4, 2019
scripts Fixup pep8 errors in populate_sample_events Sep 6, 2019
static removing path to watchlist, removing watchlist from static, adding pr… Oct 30, 2018
systemdfiles Fixup remaining mozdefalertplugin references Mar 22, 2019
tests Update geomodel location tests to call parent teardown Sep 12, 2019
.flake8 Exclude mozdef_util build directory from flake8 checks Apr 9, 2019
.gitignore Merge branch 'master' into geomodel-v-0-1 Aug 2, 2019
.travis.yml Update python version definition in travisci Jun 28, 2019 Add v3.1.1 link at bottom of changelog Jul 25, 2019
CODEOWNERS Fix path for changelog in codeowners Jul 25, 2019 Add Mozilla Code of Conduct file Mar 28, 2019 Modifying urls to point to mozilla from jeffbryner, slight readabilit… Jun 15, 2017
LICENSE Update MPL license to https Aug 1, 2019
Makefile Update MPL license to https Aug 1, 2019 update survey links Aug 11, 2019
requirements.txt Vendor celeryscheduler mongodb Aug 13, 2019

Build Status Documentation Status

MozDef: LOGO


Give MozDef a Try in AWS:

The following button will launch the Mozilla Enterprise Defense Platform in your AWS account.

Warning: Pressing the "Launch Stack" button and following through with the deployment will incur charges to your AWS account.

Launch MozDef


The inspiration for MozDef comes from the large arsenal of tools available to attackers. Suites like metasploit, armitage, lair, dradis and others are readily available to help attackers coordinate, share intelligence and finely tune their attacks in real time. Defenders are usually limited to wikis, ticketing systems and manual tracking databases attached to the end of a Security Information Event Management (SIEM) system.

The Mozilla Enterprise Defense Platform (MozDef) seeks to automate the security incident handling process and facilitate the real-time activities of incident handlers.


  • Provide a platform for use by defenders to rapidly discover and respond to security incidents
  • Automate interfaces to other systems like bunker, cymon, mig
  • Provide metrics for security events and incidents
  • Facilitate real-time collaboration amongst incident handlers
  • Facilitate repeatable, predictable processes for incident handling
  • Go beyond traditional SIEM systems in automating incident handling, information sharing, workflow, metrics and response automation


MozDef is in production at Mozilla where we are using it to process over 300 million events per day.

Survey & Contacting us

If you're interested in running MozDef and would like to give us feedback, please take the following surveys:

These survey also include a contact form where you can reach us if you would like to (it's optional)

Note: These surveys will be open for a limited amount of time, in order to ensure that we look at your feedback in a timely fashion. Thanks for your understanding!

You can’t perform that action at this time.