Detection Engineering
A curated list of resources, tools, and frameworks for detection engineering in cybersecurity.
What is Detection Engineering?
Awesome Detection Engineering is a curated GitHub repository that aggregates resources, tools, and frameworks for detection engineering—a cybersecurity discipline focused on designing and implementing detective controls to identify malicious activity. It serves as a reference hub for security professionals building threat detection programs.
Detection engineers, threat hunters, security analysts, and SOC teams looking for practical resources to improve their organization's threat detection capabilities.
It saves time by compiling scattered detection engineering resources into a single, well-organized list, covering everything from foundational frameworks to ready-to-use detection rules and logging best practices.
Overview
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
Use Cases
Best For
- Security teams building a detection engineering program from scratch
- Threat hunters seeking new detection techniques and data sources
- SOC analysts looking for pre-built detection rules for SIEM platforms
- Security engineers implementing MITRE ATT&CK-based detection coverage
- Cloud security teams needing detection content for AWS, GCP, or Azure
- Detection engineers researching logging standards and data normalization
Not Ideal For
- Teams seeking an all-in-one detection platform with integrated tools and GUIs
- Organizations needing vendor-specific, hands-on tutorials or implementation support
- Projects requiring real-time data feeds or interactive learning environments
Pros & Cons
Pros
Aggregates diverse detection engineering materials, from MITRE ATT&CK frameworks to ready-to-use Sigma and SIEM rules, as shown in organized sections like Concepts & Frameworks and Detection Content.
Regularly maintained with contributions from the detection engineering community, ensuring the list stays relevant and up-to-date, as highlighted in the philosophy and contributing guidelines.
Provides direct links to open-source detection rules from major platforms like Splunk, Elastic, and cloud providers, enabling quick integration and adaptation for various SIEMs.
Includes multiple maturity models and frameworks such as the Detection Engineering Maturity Matrix and DML Model, helping teams assess and improve their detection programs systematically.
Cons
Acts as a passive aggregator without in-depth tutorials or original content; users must navigate external links for detailed implementation, which can be time-consuming.
Lacks any integrated tools or platforms—it's purely a reference list, so teams need to separately acquire and configure the recommended software and scripts.
Relies on external resources that may become outdated or broken over time, with no guarantee of active monitoring for all linked content, as admitted in the community-driven approach.
Frequently Asked Questions
Related Projects
HackingA curated list of awesome Hacking tutorials, tools and resources
SecurityA collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
Malware AnalysisDefund the Police.
Web Security🐶 A curated list of Web Security materials and resources.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.