Synthetic Adversarial Log Objects (SALO) | Splunk

Alerting and Detection Strategies (ADS) Framework | Palantir

A framework for developing alerting and detection strategies for incident response.

Threat Detection Maturity Framework | Haider Dost of Snowflake

A maturity matrix to measure the success of your threat detection program

Detection Engineering Field Manual | Zack Allen

a series of posts exploring the various foundational components of Detection Engineering

Open Threat Informed Detection Engineering aka OpenTide'

an all-in-one Detection Engineering Operations framework created and maintained by the European Commission to convert your CTI into an actionable detection coverage graph combining threat vectors with detection objectives, and manage your entire detection library from a central repository with a detection-as-code deployment system. The OpenTide format aims at measuring and expanding detection coverage, and its rule deployment engine is fully extensible and support multiple platforms in parallel (leveraging all the technology features and native query language). OpenTide works both within a single DE team as a main framework, and across SOC as a common format to facilitate data interexchange