A curated list of resources, tools, and frameworks for detection engineering in cybersecurity.
Awesome Detection Engineering is a curated GitHub repository that aggregates resources, tools, and frameworks for detection engineering—a cybersecurity discipline focused on designing and implementing detective controls to identify malicious activity. It serves as a reference hub for security professionals building threat detection programs.
Detection engineers, threat hunters, security analysts, and SOC teams looking for practical resources to improve their organization's threat detection capabilities.
It saves time by compiling scattered detection engineering resources into a single, well-organized list, covering everything from foundational frameworks to ready-to-use detection rules and logging best practices.
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Aggregates diverse detection engineering materials, from MITRE ATT&CK frameworks to ready-to-use Sigma and SIEM rules, as shown in organized sections like Concepts & Frameworks and Detection Content.
Regularly maintained with contributions from the detection engineering community, ensuring the list stays relevant and up-to-date, as highlighted in the philosophy and contributing guidelines.
Provides direct links to open-source detection rules from major platforms like Splunk, Elastic, and cloud providers, enabling quick integration and adaptation for various SIEMs.
Includes multiple maturity models and frameworks such as the Detection Engineering Maturity Matrix and DML Model, helping teams assess and improve their detection programs systematically.
Acts as a passive aggregator without in-depth tutorials or original content; users must navigate external links for detailed implementation, which can be time-consuming.
Lacks any integrated tools or platforms—it's purely a reference list, so teams need to separately acquire and configure the recommended software and scripts.
Relies on external resources that may become outdated or broken over time, with no guarantee of active monitoring for all linked content, as admitted in the community-driven approach.