Concepts & Frameworks
0 projectsDetection Content & Signatures
4 projects
Sigma RulesA generic and open signature format for describing log event detections, shareable across SIEM systems.
Splunk Security ContentAn open-source repository of security detections, analytic stories, and response playbooks mapped to MITRE ATT&CK for Splunk Enterprise Security.
Elastic Detection RulesA public repository for developing, testing, and maintaining detection rules for Elastic Security's SIEM, with tools for Detections as Code.
KQL Advanced Hunting Queries & Analytics RulesA collection of ready-to-use KQL queries for threat hunting, detection, and analytics in Microsoft Defender for Endpoint and Azure Sentinel.
Logging, Monitoring & Data Sources
4 projectsLinux auditd Detection RulesetA production-ready auditd configuration for Linux security monitoring that works out-of-the-box across major distributions.
LoghubA large collection of real-world system log datasets for AI-driven log analytics research.
Elastalert | YelpA simple framework for alerting on anomalies, spikes, or other patterns in Elasticsearch data.
MatanoAn open source, serverless security data lake for AWS that normalizes logs, enables detection-as-code, and supports petabyte-scale threat hunting.