KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
updated at Nov. 16, 2024, 12:03 p.m.
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
updated at Nov. 15, 2024, 9:32 p.m.
A framework for developing alerting and detection strategies for incident response.
updated at Nov. 15, 2024, 8:58 a.m.
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
updated at Nov. 15, 2024, 2:04 a.m.
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
updated at Nov. 14, 2024, 12:11 p.m.
🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
updated at Nov. 14, 2024, 12:11 p.m.
✨ A compilation of suggested tools/services for each component in a detection and response pipeline, along with real-world examples. The purpose is to create a reference hub for designing effective threat detection and response pipelines. 👷 🏗
updated at Nov. 11, 2024, 10:11 p.m.
A curated list of resources about detecting threats and defending Kubernetes systems.
updated at Nov. 9, 2024, 3:19 p.m.
Collection of YARA-L 2.0 sample rules for the Chronicle Detection API
updated at Nov. 6, 2024, 7:30 a.m.