bluemountaincyber / building-detections-aws

Related projects ⓘ

Alternatives and complementary repositories for building-detections-aws

• bluemountaincyber / building-detections-azure
  ☆13Updated 9 months ago
• malwarejake-public / conference-presentations
  Conference presentations
  ☆47Updated last year
• gertjanbruggink / metrics
  This directory features proven systems that demonstrate value to your threat-informed efforts using metrics.
  ☆97Updated this week
• msraju / Incident-Response-Playbooks
  ☆41Updated 2 years ago
• invictus-ir / aws-cheatsheet
  A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.
  ☆62Updated 6 months ago
• socprime / the-prime-hunt
  A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation
  ☆75Updated 6 months ago
• k-bailey / detection-engineering-maturity-matrix
  ☆87Updated 2 years ago
• dlcowen / sansfor509
  Public script from SANS FOR509 Enterprise Cloud Incident Response
  ☆179Updated 2 months ago
• WillOram / AzureAD-incident-response
  Notes on responding to security breaches relating to Azure AD
  ☆96Updated 2 years ago
• cudeso / misp2sentinel
  MISP to Sentinel integration
  ☆60Updated this week
• MarkBaggett / 504lab
  Distribution of the SANS SEC504 Windows Cheat Sheet Lab
  ☆66Updated 4 years ago
• joswr1ght / basicblobfinder
  Identify Azure blobs using a wordlist of account name and container name strings
  ☆32Updated 3 years ago
• iknowjason / BlueCloud
  Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.
  ☆125Updated 2 years ago
• bluemountaincyber / evidence-app
  Serverless AWS application to upload and hash evidence files.
  ☆19Updated 2 years ago
• reversinglabs / reversinglabs-siem-rules
  A collection of various SIEM rules relating to malware family groups.
  ☆62Updated 5 months ago
• msdirtbag / ADXFlowmaster
  ADXFlowmaster helps SecOps teams Threat Hunt suspicious network traffic inside & outside of Azure.
  ☆27Updated 3 weeks ago
• bluemountaincyber / avoiding-data-disasters
  ☆12Updated last year
• SentineLabs / S1QL-Queries
  ☆52Updated last year
• invictus-ir / o365_dataset
  A dataset containing Office 365 Unified Audit Logs for security research and detection
  ☆48Updated 2 years ago
• pe3zx / crowdstrike-falcon-queries
  A collection of Splunk's Search Processing Language (SPL) for Threat Hunting with CrowdStrike Falcon
  ☆193Updated 4 years ago
• strozfriedberg / greppin-logs
  2021 SANS DFIR Summit: Greppin' Logs
  ☆21Updated 3 years ago
• blackhillsinfosec / audit-inspector
  Audit Inspector is a tool for configuring and auditing Windows auditing.
  ☆32Updated last month
• shauntdergrigorian / splunkqueries
  A list of Splunk queries that I've collected and used over time.
  ☆72Updated 4 years ago
• christian-taillon / splunk-spl
  SPL cheatsheet for Splunk.
  ☆20Updated last year
• m4nbat / KustQueryLanguage_kql
  Cyber Defence related kusto queries for use in Azure Sentinel and Defender advanced hunting
  ☆57Updated 3 weeks ago
• Resistor52 / DockerCrashCourse
  Docker Crash Course: How to containerize your favorite security tools
  ☆27Updated last year
• reflexsoar / reflex
  Reflex SOAR
  ☆12Updated 2 years ago
• Insider-Threat / Insider-Threat
  Creating a resource to help build and manage an Insider Threat program.
  ☆62Updated 7 months ago
• h0ffayyy / MicrosoftSentinelStuff
  Misc. content for Microsoft Sentinel
  ☆17Updated 7 months ago
• archanchoudhury / DFIR-Tools
  This is the One Stop place where you can find almost all of your Tools of Requirements in DFIR
  ☆71Updated 2 years ago