Sysmon

SigmaPython

A generic and open signature format for describing log event detections, shareable across SIEM systems.

Sigma RulesPython

A generic and open signature format for describing log event detections, shareable across SIEM systems.

sysmon-config

A high-quality, commented Sysmon configuration template for Windows system monitoring and incident investigation.

ThreatHunter-PlaybookPython

A community-driven open-source project that structures threat hunting workflows using MITRE ATT&CK, Jupyter notebooks, and AI-augmented planning.

sysmon-modularPowerShell

A modular repository of Sysmon configuration modules for customizable endpoint detection and logging.

DeepBlueCLIPowerShell

A PowerShell module for threat hunting and detecting malicious activity via Windows Event Logs.