tuckner's repositories
automation-capability-matrix
A tool that allows you to document and assess any security automation in your SOC
detection-rules
Rules for Elastic Security's detection engine
cuckoo-bot
Simple Slack bot to submit hashes to a Cuckoo Sandbox instance
attack-navigator-layers
Collection of ATT&CK research with ATTT&CK Navigator layers
tines-example-stories
A collection of Tines example stories as export files and Terraform.
ansible-art
Action Plugin for Ansible as an execution framework for Atomic Red Team by Red Canary
bolt-docker
A container that runs Slack Bolt to receive message events and send to a webhook
netwitness-urlscan
Context Menu for RSA NetWitness to search for a domain on urlscan.io
python-tines
Tines API Wrapper
tines-connect
ngrok container to use with Tines
vagrant-check-point
Vagrantfile for turning up Check Point firewall lab environments
ansible
Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy. Avoid writing scripts or custom code to deploy and update your applications— automate in a language that approaches plain English, using SSH, with no agents to install on remote systems.
atc-react
A knowledge base of actionable Incident Response techniques
atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
awesome-detection-engineering
A list of useful Detection Engineering-related resources.
EVTX-ATTACK-SAMPLES
Windows Events Samples
presentations
Resources and recordings for various presentations
quickstart-snyk-security
AWS Quick Start Team
Sooty
The SOC Analysts all-in-one CLI tool to automate and speed up workflow.
tines-deploy-actions
An example of how to deploy Tines stories using Github Actions and Terraform
webhook-plugin
A Chrome plugin which creates a context menu to send a page's URL and contents to a webhook