Clankerusecase
Threat-led library of 7,800+ MITRE ATT&CK-mapped detections in Defender/Sentinel KQL, Sigma, Splunk SPL, Datadog, Falcon LogScale, and AWS CloudWatch, generated from public threat-intel reporting and schema-validated before publish.
- from
- Detection Engineering
- added
- 2026-10-12
- likes
- 0
similar
-
Center for Threat Informed Defense Security Stack Mappings github.com
Describes cloud computing platform's (Azure, AWS) built-in detection capabilities and their mappings to the MITRE ATT&CK framework.
-
MITRE ATT&CK attack.mitre.org
The foundational framework of adversary tactics, techniques, and procedures based on real-world observations.
-
SOCLabs soc-labs.top
A lab for blue teamers and detection engineers, with real threat data and support for popular SIEM query languages, enabling hands-on learning and practice in detection rule writing and threat hunting.
-
KQL Advanced Hunting Queries & Analytics Rules github.com
A list of endpoint detections and hunting queries for Microsoft Defender for Endpoint, Defender For Identity, and Defender For Cloud Apps.
-
CAR Coverage Comparison car.mitre.org
A matrix of MITRE ATT&CK technique IDs and links to available Splunk Security Content, Elastic detection rules, Sigma rules, and CAR content.
-
ATT&CK Navigator | MITRE mitre-attack.github.io
MITRE's open-source tool that can be used to track detection coverage, visibility, and other efforts and their relationship to the ATT&CK framework.
Detection Engineering › Detection Content & Signatures: “Threat-led library of 7,800+ MITRE ATT&CK-mapped detections in Defender/Sentinel KQL, Sigma, Splunk SPL, Datadog, Falcon LogScale, and AWS CloudWatch, generated from public threat-intel reporting and schema-validated before publish.”