There are 15 repositories under threat-detection topic.
✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud
Proactive, Open source API security → API discovery, API Security Posture, Testing in CI/CD, Test Library with 1000+ Tests, Add custom tests, Sensitive data exposure
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.
Threat-hunting tool for Linux
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
Threatest is a CLI and Go framework for end-to-end testing threat detection rules.
A starter pack of resources to help you get started in Detection Engineering.
Bypass 403
A toolkit for Security Researchers
Crawlector is a threat hunting framework designed for scanning websites for malicious objects.
ThreatSeeker: Threat Hunting via Windows Event Logs
Online resources related to Detection Engineering. Detection rules, detection logic, attack samples, detection tests and emulation tools, logging configuration and best practices, event log references, resources, labs, data manipulation online tools, blogs, newsletters, good reads, books, trainings, podcasts, videos and twitter/x accounts.
Flash-IDS is an open-source system developed by the DART Laboratory for advanced intrusion detection using provenance graph representation learning. It implements the techniques presented in our IEEE S&P 2024 paper, "FLASH: A Comprehensive Approach to Intrusion Detection via Provenance Graph Representation Learning.
Comprehensive SOC Analyst notes covering incident response, threat hunting, SOC workflows, and cybersecurity concepts—perfect for exam prep and skill-building in blue team operations.
SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.
🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections.
To be used with tools like GoBuster & DirBuster but these lists are specifically tailored and designed for scanning phishing <>< landing pages and other malicious or sketch af financial/crypto fraud websites.
An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
Sigma detection rules for hunting with the threathunting-keywords project
Curated collection of cybersecurity tools featured in Black Hat Arsenal events.
Threat Detection & Anomaly Detection rules for popular open-source components
Threat intelligence and threat detection indicators (IOC, IOA)
Real-time eBPF-powered network security monitor with AI-driven threat detection. Surfaces port scans, DDoS attacks, botnet activity, and anomalies at 100Gbps+ speeds with sub-microsecond latency (~150 million packets/sec).
An ongoing & curated collection of awesome software best practices and remediation techniques, libraries and frameworks, E-books and videos, Technical guidelines and important resources about Threat Detection & Hunting.