PaloAltoNetworks / cortex-xql-queries
Repository for Cortex XDR and Cortex XSIAM XQL queries and more!
☆27Updated 11 months ago
Alternatives and similar repositories for cortex-xql-queries
Users that are interested in cortex-xql-queries are comparing it to the libraries listed below
Sorting:
- A collection of various SIEM rules relating to malware family groups.☆66Updated 10 months ago
- Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs☆53Updated last year
- Digital Forensic Analysis and Incident Response Playbooks to handle real world security incidents☆41Updated last year
- User Feedback Space of #MitreAssistant☆37Updated last year
- A tool that allows you to document and assess any security automation in your SOC☆46Updated 6 months ago
- ☆47Updated last month
- The Infosec Community Definitive Guide to Jupyter Notebooks☆121Updated 4 years ago
- Tool to extract Sessions, MessageID(s) and find the emails belonging to MessageID(s). This script utilizes the MailItemsAccessed features…☆41Updated 4 years ago
- The idea is simply to save some quick notes that will make it easier for Splunk users to leverage KQL (Kusto), especially giving projects…☆42Updated 4 years ago
- MISP to Sentinel integration☆67Updated last month
- ☆72Updated 6 months ago
- Security Scripts and Sources for daily usage.☆59Updated last month
- Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…☆39Updated this week
- ☆43Updated 2 years ago
- Hunting Queries for Defender ATP☆81Updated last month
- Cyber Defence related kusto queries for use in Azure Sentinel and Defender advanced hunting☆65Updated last month
- KQL queries for cyber defense and for solving daily issues☆49Updated 3 months ago
- CrowdStrike's Open Source Policy & Contribution Guide☆39Updated last month
- Conference presentations☆47Updated last year
- Cybersecurity Incident Response Plan☆91Updated 4 years ago
- Ingesting Shodan Monitor Alerts to Microsoft Sentinel☆34Updated last year
- A collection of ARM-based detections for Azure/AzureAD based TTPs☆85Updated last year
- An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.☆56Updated 3 years ago
- Collects a listing of MITRE ATT&CK Techniques, then discovers Splunk ESCU detections for each technique☆67Updated last year
- Sharing Threat Hunting runbooks☆25Updated 5 years ago
- ☆44Updated last year
- A guide to using Azure Data Explorer and KQL for DFIR☆102Updated 3 years ago
- An automated deployment tool that creates instrumented Azure environments with vulnerable systems for simulating attacks and testing Micr…☆43Updated 2 weeks ago
- Distribution of the SANS SEC504 Windows Cheat Sheet Lab☆69Updated 4 years ago
- ☆29Updated 2 weeks ago