Ridgeline Detection Library
Production-validated detections across nine platforms (KQL, Sigma, Splunk, Athena, PowerShell, Velociraptor, YARA, Suricata, osquery), each with triggers, false positives, tuning guidance, and validation steps. Apache-2.0.
- from
- Detection Engineering
- added
- 2026-10-12
- likes
- 0
similar
-
KQL Advanced Hunting Queries & Analytics Rules github.com
A list of endpoint detections and hunting queries for Microsoft Defender for Endpoint, Defender For Identity, and Defender For Cloud Apps.
-
-
recon github.com
a fast Rust based CLI that uses SQL to query over files, code, or malware with content classification and processing for security experts
-
Clankerusecase clankerusecase.com
Threat-led library of 7,800+ MITRE ATT&CK-mapped detections in Defender/Sentinel KQL, Sigma, Splunk SPL, Datadog, Falcon LogScale, and AWS CloudWatch, generated from public threat-intel reporting and schema-validated before publish.
-
-
Detection and Response Pipeline github.com
A list of tools for each component of a detection and response pipeline which includes real-world examples.
Detection Engineering › Detection Content & Signatures: “Production-validated detections across nine platforms (KQL, Sigma, Splunk, Athena, PowerShell, Velociraptor, YARA, Suricata, osquery), each with triggers, false positives, tuning guidance, and validation steps. Apache-2.0.”