30 results found Sort:

0x4D31
awesome-threat-detection 0x4D31
692
4.1k
unknown
197
✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️
awesome security detection awesome-list threat-hunting threat-detection incident-response
Created 2018-01-13
148 commits to master branch, last one about a year ago
elastic
detection-rules elastic
557
2.3k
other
90
This repository has no description...
threat-hunting threat-detection
Created 2020-06-17
2,731 commits to main branch, last one a day ago
DataDog
stratus-red-team DataDog
240
2.0k
apache-2.0
37
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
aws security purple-team aws-security gcp-security mitre-attack azure-security cloud-security threat-detection adversary-emulation kubernetes-security cloud-native-security detection-engineering
Created 2022-01-07
732 commits to main branch, last one about a month ago
akto-api-security
akto akto-api-security
237
1.3k
mit
17
Proactive, Open source API security → API discovery, API Security Posture, Testing in CI/CD, Test Library with 1000+ Tests, Add custom tests, Sensitive data exposure
idor security devsecops api-testing api-security owasp-top-10 api-discovery authorization hacktoberfest authentication security-testing threat-detection hacktoberfest2023 devsecops-pipeline api-security-posture api-security-testing sensitive-data-exposure
Created 2023-01-31
6,665 commits to master branch, last one a day ago
infosecB
awesome-detection-engineering infosecB
86
962
cc0-1.0
28
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying m...
mitre splunk awesome awesome-list cybersecurity threat-detection detection-engineering
Created 2020-09-26
130 commits to main branch, last one 7 days ago
thalesgroup-cert
Watcher thalesgroup-cert
132
909
agpl-3.0
37
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
misp nltk osint django webapp reactjs thehive watcher phishing security certstream monitoring rss-bridge osint-python cybersecurity threat-hunting threat-detection incident-response threat-intelligence certificate-transparency
Created 2020-09-01
470 commits to master branch, last one 16 days ago
kunai-project
kunai kunai-project
61
821
gpl-3.0
16
Threat-hunting tool for Linux
ebpf linux threat-hunting threat-detection security-monitoring
Created 2023-06-21
593 commits to main branch, last one 18 days ago
Cyb3r-Monk
Threat-Hunting-and-Detection Cyb3r-Monk
104
725
bsd-3-clause
31
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
kql dfir cybersecurity kusto-language threat-hunting threat-detection microsoft-sentinel defender-for-endpoint detection-engineering
Created 2020-11-02
31 commits to main branch, last one about a month ago
cyb3rmik3
KQL-threat-hunting-queries cyb3rmik3
75
676
mit
17
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
kql kusto security sentinel microsoft kusto-query threat-hunt microsoftxdr microsoft-365 microsoft-xdr securitycenter threat-hunting threat-detecting threat-detection microsoft-security microsoft-sentinel kusto-query-language microsoft-365-defender microsoft-365-security
Created 2022-07-19
366 commits to main branch, last one 16 days ago
turbot
tailpipe turbot
7
414
agpl-3.0
7
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
aws gcp siem azure devops duckdb parquet tailpipe forensics detections open-source log-analysis mitre-attack threat-detection incident-response
Created 2024-04-18
363 commits to develop branch, last one 7 days ago
nianticlabs
venator nianticlabs
20
375
mit
4
A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.
golang kubernetes threat-detection detection-engineering
Created 2024-09-30
11 commits to main branch, last one 6 months ago
GoogleCloudPlatform
security-analytics GoogleCloudPlatform
70
340
apache-2.0
33
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
gcp logging bigquery security chronicle audit-logs google-cloud network-logs log-analytics network-analysis threat-detection security-operations cloud-security-command-center
Created 2022-01-11
288 commits to main branch, last one 10 months ago
DataDog
threatest DataDog
23
330
apache-2.0
12
Threatest is a CLI and Go framework for end-to-end testing threat detection rules.
threat-detection continuous-security security-automation detection-engineering
Created 2022-06-16
99 commits to main branch, last one about a year ago
utmstack
UTMStack utmstack
33
265
agpl-3.0
10
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
soc cmmc siem soar soc2 hipaa security compliance log-parsing log-analysis security-audit security-tools threat-hunting threat-analysis threat-detection incident-response malware-detection security-automation threat-intelligence security-operations-center
Created 2023-09-19
1,959 commits to main branch, last one 2 days ago
jackaduma
SecBERT jackaduma
34
178
mit
5
pretrained BERT model for cyber security text, learned CyberSecurity Knowledge
apt nlp bert security attention deeplearning transformers cybersecurity cyber-security threat-hunting bert-embeddings threat-analysis threat-detection security-automation threat-intelligence transformer-encoder nlp-machine-learning deep-learning-security cyber-threat-intelligence machine-learning-security
Created 2020-10-27
18 commits to main branch, last one about a year ago
spyboy-productions
WebSecProbe spyboy-productions
22
142
mit
3
Bypass 403
access-403 bypass-403 header-injection threat-detection url-manipulation payload-variations web-security-audit historical-analysis http-request-analysis security-assessment-tool vulnerability-assessment web-application-security wayback-machine-integration web-vulnerability-detection
Created 2023-09-14
46 commits to main branch, last one 2 months ago
MFMokbel
Crawlector MFMokbel
10
126
mit
5
Crawlector is a threat hunting framework designed for scanning websites for malicious objects.
threat-hunting threat-detection malware-detection
Created 2021-02-01
79 commits to main branch, last one about a year ago
ine-labs
ThreatSeeker ine-labs
13
120
mit
5
ThreatSeeker: Threat Hunting via Windows Event Logs
evtx sysmon threat windows log-analysis threat-detection threat-intelligence
Created 2023-04-11
4 commits to master branch, last one about a year ago
st0pp3r
awesome-detection-engineer st0pp3r
12
87
cc0-1.0
4
Online resources related to Detection Engineering. Detection rules, detection logic, attack samples, detection tests and emulation tools, logging configuration and best practices, event log reference...
soc awesome security detection awesome-list cybesecurity threat-detection detection-engineering
Created 2025-01-26
242 commits to main branch, last one 3 days ago
jonrau1
SyntheticSun jonrau1
16
78
gpl-3.0
6
SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to cont...
aws misp kibana guardduty sagemaker automation serverless geolocation aws-security data-science elasticsearch aws-serverless security-tools machine-learning threat-detection anomaly-detection incident-response data-visualization security-automation threat-intelligence
Created 2020-04-21
90 commits to master branch, last one 3 years ago
AlbinoGazelle
esxi-testing-toolkit AlbinoGazelle
8
72
mit
1
🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.
esxi python infosec security purple-team security-tools threat-detection detection-engineering
Created 2024-12-15
124 commits to main branch, last one 5 days ago
DART-Laboratory
Flash-IDS DART-Laboratory
21
64
unknown
1
Flash-IDS is an open-source system developed by the DART Laboratory for advanced intrusion detection using provenance graph representation learning. It implements the techniques presented in our IEEE ...
logs attack threat-hunting threat-detection graph-neural-networks forensics-investigations intrusion-detection-system
Created 2023-10-28
3 commits to main branch, last one 11 months ago
mthcht
ThreatHunting-Keywords-sigma-rules mthcht
7
55
unknown
3
Sigma detection rules for hunting with the threathunting-keywords project
dfir siem blueteam sigma-rules mitre-attack threathunting threat-hunting detection-rules threat-detection forensicartifacts detection-engineering
Created 2023-08-02
88 commits to main branch, last one about a month ago
infosecB
detection-as-code infosecB
14
55
gpl-3.0
2
An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
blueteam cybersecurity threat-detection detection-engineering
Created 2021-11-21
6 commits to main branch, last one 3 years ago
Loginsoft-LLC
threat-detection-rules Loginsoft-LLC
10
51
gpl-3.0
3
Threat Detection & Anomaly Detection rules for popular open-source components
siem sigma splunk elasticsearch threat-hunting threat-detection anomaly-detection
Created 2020-08-07
31 commits to master branch, last one 2 years ago
infosecB
Rulehound infosecB
5
44
unknown
1
An index of publicly available and open-source threat detection rulesets.
index rules ruleset cybersecurity threat-detection detection-engineering
Created 2025-04-04
2 commits to main branch, last one 15 days ago
spmedia
PhishingSecLists spmedia
5
43
gpl-3.0
1
To be used with tools like GoBuster & DirBuster but these lists are specifically tailored and designed for scanning phishing <>< landing pages and other malicious or sketch af financial/crypto fraud w...
cti scanner threats phishing scanners scanning seclists brute-force scanner-web threatintel threat-hunting threat-detection brute-force-search threat-intelligence cyber-threat-intelligence
Created 2023-01-26
176 commits to main branch, last one 8 days ago
paulveillard
cybersecurity-threat-detection paulveillard
9
42
mit
5
An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and videos, Technical guidelines and important resources about Threat D...
cybersecurity security-tools threat-blocker threat-hunting threat-monitor threat-analysis threat-explorer threat-modeling threat-response malware-analysis threat-detection malware-detection malware-development threat-intelligence encryption-decryption security-vulnerability threat-detection-policy
Created 2021-12-12
13 commits to main branch, last one 2 years ago
krdmnbrk
atomicgen.io krdmnbrk
4
39
apache-2.0
1
A simple tool designed to create Atomic Red Team tests with ease.
red-team blue-team purple-team atomicredteam threat-detection detection-engineering
Created 2024-11-22
23 commits to main branch, last one about a month ago
zcyberseclab
zscan zcyberseclab
2
37
other
3
A fast, customizable service detection tool powered by a flexible fingerprint system. It helps you identify services, APIs, and network configurations across your infrastructure.
golang red-team port-scanner web-security pentest-tools security-tools network-security security-scanner threat-detection service-detection pentest-tools-2024 penetration-testing vulnerability-scanner fingerprint-recognition
Created 2024-11-06
109 commits to main branch, last one 2 months ago