Detection Engineering

Alerting and Detection Strategies (ADS) Framework | Palantir

A framework for developing rigorous, documented alerting and detection strategies to improve incident response efficacy.

Synthetic Adversarial Log Objects (SALO) | Splunk

A Python framework for generating synthetic log events without requiring actual infrastructure or actions.

Sigma Rules

A generic and open signature format for describing log event detections, shareable across SIEM systems.

Splunk Security Content

An open-source repository of security detections, analytic stories, and response playbooks mapped to MITRE ATT&CK for Splunk Enterprise Security.

Elastic Detection Rules

A public repository for developing, testing, and maintaining detection rules for Elastic Security's SIEM, with tools for Detections as Code.

Elastic Endpoint Behavioral Rules

Open-source detection logic (rules, YARA, EQL) for Elastic Security's endpoint protection against malware, ransomware, and advanced threats.

Elastic Yara Signatures

Open-source detection logic (rules, YARA, ransomware protection) for Elastic Security's endpoint protection platform.

Chronicle (GCP) Detection Rules

A collection of example YARA-L detection rules and dashboards for Google Security Operations (SecOps).

Exabeam Content Library

An online repository of Exabeam's security detection content, including data sources, use cases, and rules based on the Common Information Model 2.0.

Panther Labs Detection Rules

A collection of built-in detection rules and policies for Panther, a modern SIEM, enabling security monitoring as code.

Anvilogic Detection Armory

An open-source repository of cybersecurity detection rules and threat identifiers for security teams to enhance threat detection capabilities.

Center for Threat Informed Defense Security Stack Mappings

A collection of native security controls for major cloud platforms mapped to MITRE ATT&CK techniques to enable threat-informed defense decisions.

Detection Engineering with Splunk

A collection of Splunk SPL queries for detecting vulnerability exploits, malware, and MITRE ATT&CK TTPs in security logs.

Google Cloud Security Analytics

A community-driven collection of pre-built security analytics queries and rules for auditing and threat detection in Google Cloud.

KQL Advanced Hunting Queries & Analytics Rules

A collection of ready-to-use KQL queries for threat hunting, detection, and analytics in Microsoft Defender for Endpoint and Azure Sentinel.

Sigma2KQL

Automatically converts Sigma detection rules to Kusto Query Language (KQL) for Microsoft Defender and Sentinel.

TerraSigma

Automates conversion of Sigma rules to Terraform and Sentinel YAML for detection engineering in Microsoft Sentinel.

Linux auditd Detection Ruleset

A production-ready auditd configuration for Linux security monitoring that works out-of-the-box across major distributions.

Exabeam Common Information Model

A hierarchical framework defining the structure of security content across Exabeam products for event normalization and analysis.

Loghub

A large collection of real-world system log datasets for AI-driven log analytics research.

Elastalert | Yelp

A simple framework for alerting on anomalies, spikes, or other patterns in Elasticsearch data.

Matano

An open source, serverless security data lake for AWS that normalizes logs, enables detection-as-code, and supports petabyte-scale threat hunting.

InnerWarden

An autonomous open-source security agent for Linux that detects, scores, and automatically responds to threats using eBPF, AI, and collaborative defense.

Awesome Kubernetes (K8s) Threat Detection

A curated list of resources for detecting threats and defending Kubernetes systems.

Detection and Response Pipeline

A curated reference hub of tools and real-world examples for designing effective threat detection and response pipelines.

Splunk ES Correlation Searches Best Practices | OpsTune

A collection of Splunk SPL queries and prototypes for threat hunting and detection engineering.