Detection Engineering
74 items from infosecb/awesome-detection-engineering ★1,356
-
-
Matano github.com
Open source serverless security lake platform on AWS that lets you ingest, store, and analyze petabytes of security data into an Apache Iceberg data lake and run realtime Python detections as code.
-
Elastalert | Yelp github.com
ElastAlert is a simple framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch.
-
-
KQL Advanced Hunting Queries & Analytics Rules github.com
A list of endpoint detections and hunting queries for Microsoft Defender for Endpoint, Defender For Identity, and Defender For Cloud Apps.
-
Agent Threat Rules (ATR) github.com
An open MIT detection-rule standard for AI-agent and MCP attacks (prompt injection, tool poisoning, context exfiltration), like Sigma or YARA for the agent layer, with OWASP LLM/Agentic and MITRE ATLAS mappings on each rule.
-
Splunk Security Content github.com
Splunk's open-source and frequently updated detection content that can be tweaked for use in other tools.
-
Alerting and Detection Strategies (ADS) Framework | Palantir github.com
A blueprint for creating and documenting effective detection content.
-
timescale/rsigma github.com
[rsigma] - A complete detection engineering toolkit for the Sigma detection standard, with a parser, evaluation engine, rule conversion, streaming runtime, linter, CLI, MCP, and LSP
-
Chronicle (GCP) Detection Rules github.com
Chronicle's detection rules written natively for the Chronicle Platform.
-
Rustinel | Karib0u github.com
Open-source endpoint detection engine for Windows and Linux that collects ETW/eBPF telemetry and evaluates Sigma, YARA, and IOC detections.
-
Center for Threat Informed Defense Security Stack Mappings github.com
Describes cloud computing platform's (Azure, AWS) built-in detection capabilities and their mappings to the MITRE ATT&CK framework.
-
Google Cloud Security Analytics github.com
This repository serves as a community-driven list of sample security analytics for auditing cloud usage and for detecting threats to your data & workloads in Google Cloud.
-
Detection and Response Pipeline github.com
A list of tools for each component of a detection and response pipeline which includes real-world examples.
-
Anvilogic Detection Armory github.com
Anvilogic's opensource and publicly available detection content.
-
Synthetic Adversarial Log Objects (SALO) | Splunk github.com
Synthetic Adversarial Log Objects (SALO) is a framework for the generation of log events without the need for infrastructure or actions to initiate the event that causes a log event.
-
SOCTalk github.com
Open source, LLM driven SOC automation platform for MSPs and MSSPs built on Wazuh. Triages, investigates, and escalates alerts through a two tier AI pipeline with human in the loop review, multi tenant isolation, and a no code triage policy editor backed by deterministic…
-
Detection Engineering with Splunk github.com
A GitHub repo dedicated to sharing detection analytics in SPL.
-
ZettelForge github.com
Agentic memory system that treats Sigma and YARA rules as first-class memory entities, with an LLM rule explainer, STIX 2.1 knowledge graph of CTI entities, and offline-first RAG to connect rules to the actors and techniques they detect. Python, MIT.
-
osquery osquery.io
osquery is an instrumentation framework that expose the operating system as a high-performance relational database.
-
Exabeam Content Library github.com
Exabeam's out of the box detection content compatible with the Exabeam Common Information Model.
-
ThreatMapper | Andrey Pautov github.com
CTI-to-detection workbench for mapping threat reports to ATT&CK, comparing TTP overlap with groups and campaigns, identifying detection gaps, and exporting analyst-ready outputs.
-
TerraSigma github.com
A repository of all SIGMA rules converted to Microsoft Sentinel Terraform Scheduled analytic resources. The repository runs on a weekly schedule to update the repository and align with the up to date version of the SIGMA rules repository. Proper entity mapping is completed for…
-
Sigma2KQL github.com
A repository of all SIGMA rules converted to KQL that runs on a weekly schedule to update the repository and align with the up to date version of the SIGMA rules repository.
-
Exabeam Common Information Model github.com
Exabeam's proprietary model used as a framework for normalizing security data.
-
Detection Engineering Twitter List | Zack Allen x.com
A Twitter list of Detection Engineering thought leaders.
-
Cloud Threat Landscape | Wiz threats.wiz.io
A cloud detection engineering-focused database, that lists threat actors known to have compromised cloud environments, the tools and techniques in their arsenal, and the technologies they prefer to target.
-
SOCLabs soc-labs.top
A lab for blue teamers and detection engineers, with real threat data and support for popular SIEM query languages, enabling hands-on learning and practice in detection rule writing and threat hunting.
-
Sigma rule converter sigconverter.io
An opensource tool that can convert detection content for use with most SIEMs.
-
Open Cybersecurity Schema Framework (OCSF) schema.ocsf.io
An opensource security data source and event schema.
- next page of items loading…
