Detection Engineering

Sigma RulesPython

A generic and open signature format for describing log event detections, shareable across SIEM systems.

Awesome Threat Detection and Hunting

A curated list of awesome open-source tools, detection rules, datasets, and resources for threat detection and hunting.

ThreatHunter-PlaybookPython

A community-driven open-source project that structures threat hunting workflows using MITRE ATT&CK, Jupyter notebooks, and AI-augmented planning.

Windows Events Attack SamplesHTML

A collection of 200 Windows EVTX event log samples mapped to MITRE ATT&CK techniques for detection testing and threat hunting.

Splunk Security ContentPython

An open-source repository of security detections, analytic stories, and response playbooks mapped to MITRE ATT&CK for Splunk Enterprise Security.

Detection Engineering

A curated list of resources, tools, and frameworks for detection engineering in cybersecurity.

Alerting and Detection Strategies (ADS) Framework | Palantir

A framework for developing rigorous, documented alerting and detection strategies to improve incident response efficacy.

PANIXShell

A modular Linux persistence framework for security research, detection engineering, and penetration testing.

LeonidasPython

A framework for executing and detecting cloud attacker TTPs via YAML definitions, generating APIs, Sigma rules, and documentation.

Google Cloud Security AnalyticsPython

A community-driven collection of pre-built security analytics queries and rules for auditing and threat detection in Google Cloud.

Detection and Response Pipeline

A curated reference hub of tools and real-world examples for designing effective threat detection and response pipelines.

Splunk ES Correlation Searches Best Practices | OpsTune

A collection of Splunk SPL queries and prototypes for threat hunting and detection engineering.

Anvilogic Detection Armory

An open-source repository of cybersecurity detection rules and threat identifiers for security teams to enhance threat detection capabilities.

Detection Engineering with Splunk

A collection of Splunk SPL queries for detecting vulnerability exploits, malware, and MITRE ATT&CK TTPs in security logs.

Sigma2KQLPython

Automatically converts Sigma detection rules to Kusto Query Language (KQL) for Microsoft Defender and Sentinel.

TerraSigmaHCL

Automates conversion of Sigma rules to Terraform and Sentinel YAML for detection engineering in Microsoft Sentinel.