acquiredsecurity / SentinelOne-ThreatHunting-and-XDR-GuideLinks
Beginners Guide to Hunting for Threats
☆14Updated last month
Alternatives and similar repositories for SentinelOne-ThreatHunting-and-XDR-Guide
Users that are interested in SentinelOne-ThreatHunting-and-XDR-Guide are comparing it to the libraries listed below
Sorting:
- SentinelOne STAR Rules☆62Updated 3 months ago
- ☆59Updated last year
- ☆72Updated 7 months ago
- Cyber Defence related kusto queries for use in Azure Sentinel and Defender advanced hunting☆65Updated 2 months ago
- Hunting Queries for Defender ATP☆82Updated last month
- Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations☆88Updated 10 months ago
- A collection of various SIEM rules relating to malware family groups.☆66Updated 11 months ago
- Project based on RegRipper, to extract add'l value/pivot points from TLN events file☆85Updated 3 months ago
- Notes on responding to security breaches relating to Azure AD☆111Updated 3 years ago
- MISP to Sentinel integration☆67Updated last week
- A dataset containing Office 365 Unified Audit Logs for security research and detection☆52Updated 2 years ago
- MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity☆90Updated 4 years ago
- Velociraptor Server hosted in Azure App Service☆54Updated this week
- ☆29Updated last month
- A preconfigured Velociraptor triage collector☆52Updated last week
- Full of public notes and Utilities☆113Updated 3 months ago
- A repository to share publicly available Velociraptor detection content☆170Updated this week
- Generates a detailed CSV file containing Sigma Rules statistics for each service or category, and each level, offering a holistic view of…☆10Updated last year
- Various PowerShells scripts I've made (or others have made) to automate some of the boring stuff in my everyday DFIR journey!☆46Updated 8 months ago
- Tool to extract Sessions, MessageID(s) and find the emails belonging to MessageID(s). This script utilizes the MailItemsAccessed features…☆41Updated 4 years ago
- Microsoft 365 Advanced Hunting Queries with hotlinks that plug the query right into your tenant.☆123Updated 10 months ago
- Azure function to insert MISP data in to Azure Sentinel☆32Updated 2 years ago
- Provides an advanced input.conf file for Windows and 3rd party related software with more than 70 different event log mapped to the MITRE…☆90Updated last week
- This repository contains helper scripts and custom configs to get the best out of Google's Timesketch project.☆109Updated last year
- Advanced Threat Hunting: Ransomware Group☆20Updated 5 months ago
- A PowerShell incident response script for quick triage☆80Updated 2 years ago
- ☆7Updated 7 months ago
- Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…☆41Updated 3 weeks ago
- Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs☆54Updated last year
- Repository of SentinelOne Deep Visibility queries.☆127Updated 3 years ago