The principal objective of this project is to develop a knowledge base of the tactics, techniques, and procedures (TTPs) used by insiders in the IT environment. It will establish an Insider Threat TTP Knowledge Base, built upon data collected on insider threat incidents and lessons learned and experience from the ATT&CK knowledge base.
☆160Jul 6, 2026Updated 3 months ago
Alternatives and similar repositories for insider-threat-ttp-kb
Users that are interested in insider-threat-ttp-kb are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Creating a resource to help build and manage an Insider Threat program.☆106Jun 4, 2026Updated 4 months ago
- Top ATT&CK Techniques helps defenders approach the breadth and complexity of MITRE ATT&CK® with a prioritized top 10 list of techniques t…☆129Updated this week
- Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by devel…☆790Updated this week
- ☆19Sep 13, 2021Updated 5 years ago
- This use case aims to leverage stream reasoning techniques and the concept of semantic importance to detect one attacking type of the ins…☆23Jan 9, 2017Updated 9 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- TRAM is an open-source platform designed to advance research into automating the mapping of cyber threat intelligence reports to MITRE AT…☆590May 6, 2025Updated last year
- CTI Blueprints is a free suite of templates and tools that helps Cyber Threat Intelligence analysts create high-quality, actionable repor…☆304Mar 20, 2025Updated last year
- ATT&CK Powered Suit is a browser extension that puts the complete MITRE ATT&CK® knowledge base at your fingertips with text search, conte…☆83Apr 29, 2026Updated 6 months ago
- Incident Response Report Using GitHub-Sphinx☆21Oct 28, 2019Updated 7 years ago
- 🚨ATTENTION🚨 The NIST 800-53 mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept…☆501Apr 3, 2024Updated 2 years ago
- A agentic Intel to hunt pipeline. Get hunting faster☆15Oct 19, 2026Updated last week
- Splunk Security Content☆1,722Updated this week
- An application allowing users to explore, create, annotate, and share extensions of the MITRE ATT&CK® knowledge base. This repository con…☆443Updated this week
- A Pythonic Detection Rules Framework☆14Updated this week
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Detect Tactics, Techniques & Combat Threats☆2,353Oct 19, 2026Updated last week
- A web API for various cyber threat intelligence frameworks, including MITRE ATT&CK, CWE, ATLAS...☆23Updated this week
- An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.☆2,176May 28, 2025Updated last year
- Detection engineering with durable memory, a five-stage lifecycle, and an agentic surface — the sibling of ATHF.☆35Oct 14, 2026Updated 2 weeks ago
- A dataset of phishing kits in the wild☆15Jun 1, 2024Updated 2 years ago
- Notes on managing and coordinating the response to major cyber incidents☆41May 30, 2020Updated 6 years ago
- Searches for Insider Threat Hunting☆30May 2, 2019Updated 7 years ago
- 🚨ATTENTION🚨 The Security Stack Mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is k…☆388Apr 3, 2024Updated 2 years ago
- Built-in Panther detection rules and policies☆472Updated this week
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- CASCADE Server☆276Dec 8, 2022Updated 3 years ago
- The idea is simply to save some quick notes that will make it easier for Splunk users to leverage KQL (Kusto), especially giving projects…☆45Nov 7, 2020Updated 5 years ago
- Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).☆831Oct 21, 2026Updated last week
- Knowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL) (ALPHA STATE AT THE MOMENT)☆104Aug 12, 2026Updated 2 months ago
- Microsoft Sentinel Incident Tasks Recipes☆11Nov 29, 2022Updated 3 years ago
- Repo for Automations and other solutions for Elastic SIEM/Security.☆19Jun 15, 2021Updated 5 years ago
- ☆76Jul 22, 2020Updated 6 years ago
- Incident response teams usually working on the offline data, collecting the evidence, then analyze the data☆48Jan 2, 2022Updated 4 years ago
- Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…☆69Sep 29, 2026Updated last month
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- 🚨ATTENTION🚨 The CVE mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as…☆243Apr 3, 2024Updated 2 years ago
- A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework☆357Nov 3, 2020Updated 5 years ago
- Microsoft Threat Intelligence Security Tools☆2,018Oct 19, 2026Updated last week
- ✨ A compilation of suggested tools/services for each component in a detection and response pipeline, along with real-world examples. The …☆300Feb 5, 2024Updated 2 years ago
- OSSEM Detection Model☆182Oct 11, 2022Updated 4 years ago
- Pathfinder is a plugin for mapping network vulnerabilities, scanned by CALDERA or imported by a supported network scanner, and translatin…☆131Apr 3, 2025Updated last year
- Incident Response Methodologies (IRM), also called Incident Playbook, based on the work done by the CERT Societe General☆24Dec 16, 2021Updated 4 years ago