Alternatives and similar repositories for building-detections-aws:

Users that are interested in building-detections-aws are comparing it to the libraries listed below

• bluemountaincyber / building-detections-azure
  ☆13Updated last year
• invictus-ir / aws-cheatsheet
  A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.
  ☆72Updated 11 months ago
• k-bailey / detection-engineering-maturity-matrix
  ☆93Updated 2 years ago
• gertjanbruggink / metrics
  This directory features proven systems that demonstrate value to your threat-informed efforts using metrics.
  ☆111Updated 5 months ago
• Digital-Defense-Institute / triage.zip
  A preconfigured Velociraptor triage collector
  ☆51Updated this week
• dlcowen / sansfor509
  Public script from SANS FOR509 Enterprise Cloud Incident Response
  ☆198Updated 7 months ago
• msraju / Incident-Response-Playbooks
  ☆42Updated 2 years ago
• center-for-threat-informed-defense / cloud-analytics
  Cloud Analytics helps defenders detect attacks to their cloud infrastructure by developing behavioral analytics for cloud platforms as we…
  ☆53Updated 2 years ago
• WillOram / AzureAD-incident-response
  Notes on responding to security breaches relating to Azure AD
  ☆110Updated 3 years ago
• invictus-ir / ALFA
  ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit l…
  ☆162Updated last month
• malwarejake-public / conference-presentations
  Conference presentations
  ☆47Updated last year
• PacktPublishing / Automating-Security-Detection-Engineering
  Automating Security Detection Engineering, published by Packt
  ☆54Updated 6 months ago
• megan201296 / gsuite-dfir
  ☆42Updated 4 years ago
• bluemountaincyber / avoiding-data-disasters
  ☆12Updated last year
• cylaris / awesomekql
  Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs
  ☆53Updated last year
• vectra-ai-research / derf
  DeRF (Detection Replay Framework) is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation o…
  ☆92Updated last year
• reprise99 / kql-for-dfir
  A guide to using Azure Data Explorer and KQL for DFIR
  ☆102Updated 2 years ago
• socprime / the-prime-hunt
  A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation
  ☆77Updated 11 months ago
• infosecB / detection-as-code
  An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
  ☆55Updated 3 years ago
• blueteamvillage / Project-Obsidian-DC30
  ☆41Updated 11 months ago
• msdirtbag / ADXFlowmaster
  ADXFlowmaster helps SecOps teams Threat Hunt suspicious network traffic inside & outside of Azure.
  ☆36Updated 5 months ago
• shauntdergrigorian / splunkqueries
  A list of Splunk queries that I've collected and used over time.
  ☆80Updated 4 years ago
• PacktPublishing / Practical-Threat-Detection-Engineering
  Practical Threat Detection Engineering, Published by Packt
  ☆68Updated last year
• iknowjason / BlueCloud
  Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.
  ☆133Updated 2 years ago
• joswr1ght / basicblobfinder
  Identify Azure blobs using a wordlist of account name and container name strings
  ☆40Updated last month
• christian-taillon / splunk-spl
  SPL cheatsheet for Splunk.
  ☆21Updated 2 years ago
• ml58158 / Demystifying-KQL
  Content Repo for Demystifying KQL Tutorial Series
  ☆69Updated 7 months ago
• reversinglabs / reversinglabs-siem-rules
  A collection of various SIEM rules relating to malware family groups.
  ☆66Updated 10 months ago
• microsoft / AzDetectSuite
  A collection of ARM-based detections for Azure/AzureAD based TTPs
  ☆85Updated last year
• pe3zx / crowdstrike-falcon-queries
  A collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
  ☆201Updated 4 years ago