threat-detection

There are 15 repositories under threat-detection topic.

0x4D31 / awesome-threat-detection
✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️
awesome awesome-list detection incident-response security threat-detection threat-hunting
4397
detection-rules
elastic / detection-rules
threat-detection threat-hunting
Language:Python 2421
DataDog / stratus-red-team
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
aws adversary-emulation purple-team mitre-attack cloud-security cloud-native-security detection-engineering threat-detection security aws-security azure-security kubernetes-security gcp-security
Language:Go 2185
akto-api-security / akto
Proactive, Open source API security → API discovery, API Security Posture, Testing in CI/CD, Test Library with 1000+ Tests, Add custom tests, Sensitive data exposure
api-security api-discovery api-security-testing api-testing authentication authorization devsecops idor owasp-top-10 security security-testing sensitive-data-exposure threat-detection hacktoberfest hacktoberfest2023 devsecops-pipeline api-security-posture
Language:Java 1396
infosecB / awesome-detection-engineering
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
awesome awesome-list cybersecurity detection-engineering mitre splunk threat-detection
1080
Watcher
thalesgroup-cert / Watcher
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
certificate-transparency certstream cybersecurity django incident-response misp monitoring nltk osint osint-python phishing reactjs security thehive threat-detection threat-hunting threat-intelligence watcher webapp
Language:JavaScript 1056
kunai-project / kunai
Threat-hunting tool for Linux
ebpf linux security-monitoring threat-hunting threat-detection
Language:Rust 997
Threat-Hunting-and-Detection
Cyb3r-Monk / Threat-Hunting-and-Detection
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
threat-hunting threat-detection cybersecurity defender-for-endpoint detection-engineering dfir kql kusto-language microsoft-sentinel
Language:Jupyter Notebook 791
cyb3rmik3 / KQL-threat-hunting-queries
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
kql kusto microsoft securitycenter sentinel kusto-query kusto-query-language microsoft-365 microsoft-365-defender microsoft-365-security microsoft-security microsoft-sentinel security threat-detection threat-hunt threat-hunting threat-detecting microsoft-xdr microsoftxdr
742
dev-lu / osint_toolkit
Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.
cybersecurity threat-detection threat-hunting threat-intelligence
Language:JavaScript 729
tailpipe
turbot / tailpipe
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
duckdb tailpipe aws azure detections devops forensics gcp incident-response log-analysis mitre-attack open-source parquet siem threat-detection
Language:Go 515
nianticlabs / venator
A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.
threat-detection detection-engineering golang kubernetes
Language:Go 383
utmstack / UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
compliance siem security security-audit incident-response log-analysis log-parsing malware-detection security-tools threat-analysis threat-detection threat-hunting threat-intelligence security-automation cmmc hipaa soar soc2 security-operations-center soc
Language:Java 354
olafhartong / ATTACKdatamap
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
dfir mitre-attack siem threat-detection threat-hunting
Language:PowerShell 351
GoogleCloudPlatform / security-analytics
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
security gcp google-cloud bigquery chronicle cloud-security-command-center audit-logs log-analytics logging network-analysis network-logs security-operations threat-detection
Language:Python 346
DataDog / threatest
Threatest is a CLI and Go framework for end-to-end testing threat detection rules.
continuous-security detection-engineering security-automation threat-detection
Language:Go 336
jackaduma / SecBERT
pretrained BERT model for cyber security text, learned CyberSecurity Knowledge
apt attention bert bert-embeddings cyber-security cyber-threat-intelligence cybersecurity deep-learning-security deeplearning machine-learning-security nlp nlp-machine-learning security security-automation threat-analysis threat-detection threat-hunting threat-intelligence transformer-encoder transformers
Language:Python 190
rfackroyd / detection-engineering-starter-pack
A starter pack of resources to help you get started in Detection Engineering.
detection detection-engineering threat-detection threat-hunting
172
WebSecProbe
spyboy-productions / WebSecProbe
Bypass 403
access-403 bypass-403 header-injection historical-analysis http-request-analysis payload-variations security-assessment-tool threat-detection url-manipulation vulnerability-assessment wayback-machine-integration web-application-security web-security-audit web-vulnerability-detection
Language:Jupyter Notebook 163
Rulehound
infosecB / Rulehound
An index of publicly available and open-source threat detection rulesets.
cybersecurity detection-engineering index rules ruleset threat-detection
129
ecstatic-nobel / Analyst-Arsenal
A toolkit for Security Researchers
osint cybersecurity python threat-intelligence threat-hunting threat-analysis malware-analysis certificate-transparency scanner threat-detection certstream webshell opendir defaced infosec
Language:Python 128
MFMokbel / Crawlector
Crawlector is a threat hunting framework designed for scanning websites for malicious objects.
malware-detection threat-detection threat-hunting
125
ine-labs / ThreatSeeker
ThreatSeeker: Threat Hunting via Windows Event Logs
evtx log-analysis sysmon threat threat-detection threat-intelligence windows
Language:Python 123
st0pp3r / awesome-detection-engineer
Online resources related to Detection Engineering. Detection rules, detection logic, attack samples, detection tests and emulation tools, logging configuration and best practices, event log references, resources, labs, data manipulation online tools, blogs, newsletters, good reads, books, trainings, podcasts, videos and twitter/x accounts.
awesome awesome-list detection-engineering threat-detection security cybesecurity detection soc
Language:HTML 117
DART-Laboratory / Flash-IDS
Flash-IDS is an open-source system developed by the DART Laboratory for advanced intrusion detection using provenance graph representation learning. It implements the techniques presented in our IEEE S&P 2024 paper, "FLASH: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning.
attack forensics-investigations intrusion-detection-system logs threat-detection threat-hunting graph-neural-networks
Language:Jupyter Notebook 85
MaheshShukla1 / SOC-Analyst-Notes
Comprehensive SOC Analyst notes covering incident response, threat hunting, SOC workflows, and cybersecurity concepts—perfect for exam prep and skill-building in blue team operations.
blue-team cyber-defense cybersecurity cybersecurity-notes cybersecurity-training incident-response security-analyst security-operations-center soc threat-detection
83
SyntheticSun
jonrau1 / SyntheticSun
SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.
anomaly-detection automation aws aws-security aws-serverless data-science data-visualization elasticsearch geolocation guardduty incident-response kibana machine-learning misp sagemaker security-automation security-tools serverless threat-detection threat-intelligence
Language:Python 80
esxi-testing-toolkit
AlbinoGazelle / esxi-testing-toolkit
🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.
detection-engineering esxi infosec security security-tools purple-team python threat-detection
Language:Python 79
PhishingSecLists
spmedia / PhishingSecLists
To be used with tools like GoBuster & DirBuster but these lists are specifically tailored and designed for scanning phishing <>< landing pages and other malicious or sketch af financial/crypto fraud websites.
phishing scanning brute-force brute-force-search cyber-threat-intelligence seclists cti threat-hunting threat-intelligence threatintel scanner scanner-web scanners threat-detection fuzzing fuzzing-tool fuzzing-wordlist wordlists seclists-download wordlist-technique
61
infosecB / detection-as-code
An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
blueteam cybersecurity detection-engineering threat-detection
Language:Python 58
ThreatHunting-Keywords-sigma-rules
mthcht / ThreatHunting-Keywords-sigma-rules
Sigma detection rules for hunting with the threathunting-keywords project
blueteam detection-engineering detection-rules siem sigma-rules threat-detection threat-hunting threathunting dfir forensicartifacts mitre-attack
Language:Python 56
elbraino / awesome-blackhat-arsenal
Curated collection of cybersecurity tools featured in Black Hat Arsenal events.
blackhat-arsenal blue-teaming cybersecurity defensive-security hacking-tools malware-analysis network-security offensive-security open-source-security red-teaming reverse-engineering security-tools threat-detection web-security osint-tool osint awesome awesome-list
Language:Python 55
Loginsoft-LLC / threat-detection-rules
Threat Detection & Anomaly Detection rules for popular open-source components
siem threat-detection sigma elasticsearch anomaly-detection threat-hunting splunk
53
swisscom / detections
Threat intelligence and threat detection indicators (IOC, IOA)
detection indicators indicators-of-compromise threat-detection
Language:YARA 52
alexhraber / flowhawk
Real-time eBPF-powered network security monitor with AI-driven threat detection. Surfaces port scans, DDoS attacks, botnet activity, and anomalies at 100Gbps+ speeds with sub-microsecond latency (~150 million packets/sec).
anomaly-detection cybersecurity ddos-protection ebpf golang intrusion-detection machine-learning network-analysis network-security packet-processing real-time-monitoring threat-detection xdp zero-day-detection
Language:Go 49
paulveillard / cybersecurity-threat-detection
An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and videos, Technical guidelines and important resources about Threat Detection & Hunting.
threat-hunting threat-intelligence threat-modeling threat-response threat-detection cybersecurity security-tools security-vulnerability malware-analysis malware-detection malware-development encryption-decryption threat-analysis threat-blocker threat-detection-policy threat-explorer threat-monitor
48

threat-detection

0x4D31 / awesome-threat-detection

elastic / detection-rules

DataDog / stratus-red-team

akto-api-security / akto

infosecB / awesome-detection-engineering

thalesgroup-cert / Watcher

kunai-project / kunai

Cyb3r-Monk / Threat-Hunting-and-Detection

cyb3rmik3 / KQL-threat-hunting-queries

dev-lu / osint_toolkit

turbot / tailpipe

nianticlabs / venator

utmstack / UTMStack

olafhartong / ATTACKdatamap

GoogleCloudPlatform / security-analytics

DataDog / threatest

jackaduma / SecBERT

rfackroyd / detection-engineering-starter-pack

spyboy-productions / WebSecProbe

infosecB / Rulehound

ecstatic-nobel / Analyst-Arsenal

MFMokbel / Crawlector

ine-labs / ThreatSeeker

st0pp3r / awesome-detection-engineer

DART-Laboratory / Flash-IDS

MaheshShukla1 / SOC-Analyst-Notes

jonrau1 / SyntheticSun

AlbinoGazelle / esxi-testing-toolkit

spmedia / PhishingSecLists

infosecB / detection-as-code

mthcht / ThreatHunting-Keywords-sigma-rules

elbraino / awesome-blackhat-arsenal

Loginsoft-LLC / threat-detection-rules

swisscom / detections

alexhraber / flowhawk

paulveillard / cybersecurity-threat-detection