airbus-cert / Splunk-ETW
A Splunk Technology Add-on to forward filtered ETW events.
☆30Updated 4 years ago
Related projects ⓘ
Alternatives and complementary repositories for Splunk-ETW
- Extract BITS jobs from QMGR queue and store them as CSV records☆74Updated 4 months ago
- ☆31Updated last month
- A collection of typical false positive indicators☆54Updated 3 years ago
- A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small Velociraptor R&D lab.☆20Updated 3 years ago
- ☆15Updated 3 years ago
- ☆39Updated 5 years ago
- Volatility plugins created by the author☆44Updated 9 years ago
- pollen - A command-line tool for interacting with TheHive☆34Updated 5 years ago
- pocket guide for core threat hunting concepts☆23Updated 4 years ago
- Collection of useful, up to date, Carbon Black Response Queries☆83Updated 4 years ago
- Stand-alone parser for User Access Logging from Server 2012 and newer systems☆71Updated 10 months ago
- Threat intelligence and threat detection indicators (IOC, IOA)☆53Updated 3 years ago
- Site for IWS book content☆18Updated 6 years ago
- Publicly shareable windows event log message data☆27Updated 4 years ago
- Public Landing Page☆16Updated last year
- Random hunting ordiented yara rules☆95Updated last year
- The project was moved here https://github.com/atomic-threat-coverage/atomic-threat-coverage☆23Updated 5 years ago
- A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.☆39Updated 2 years ago
- A list of Mitre Caldera compatible emulation-plans☆14Updated 3 years ago
- Threat Box Assessment Tool☆19Updated 3 years ago
- CSIRT Jump Bag☆27Updated 6 months ago
- Splunk app for Threat hunting☆15Updated 6 years ago
- A repo to document API functions mapped to security events across diverse platforms☆74Updated 5 years ago
- PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.☆56Updated 2 years ago
- Automated detection rule analysis utility☆29Updated 2 years ago
- Parses IE's Automatic Crash Recovery Files☆16Updated 7 years ago
- An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree…☆59Updated 6 years ago
- Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.☆63Updated last year