elastic / security-action-examples
This repository contains a few examples of actions that can be added to rules within Elastic Security.
☆22Updated 3 months ago
Alternatives and similar repositories for security-action-examples
Users that are interested in security-action-examples are comparing it to the libraries listed below
Sorting:
- Technical add-on for Splunk related to TheHive/Cortex from TheHive project☆53Updated 3 weeks ago
- Translate an ECS mapping CSV to starter pipelines for Beats, Elasticsearch or Logstash☆54Updated 3 years ago
- SIEM Logstash parsing for more than hundred technologies☆184Updated 3 weeks ago
- SIEGMA - Transform Sigma rules into SIEM consumables☆149Updated 2 months ago
- Parse wazuh[HIDS] alerts into ECS mapping using Filebeat☆27Updated 4 years ago
- Mapping Corelight or Zeek data to Elastic Common Schema fields☆34Updated 3 weeks ago
- Converts Netwitness log parser configuration to Logstash configuration☆20Updated 4 years ago
- Templates for Cribl Stream Collectors☆42Updated 2 weeks ago
- ☆34Updated 3 months ago
- Dettectinator - The Python library to your DeTT&CT YAML files.☆111Updated last month
- ☆94Updated 2 years ago
- A Sigma to Wazuh / OSSEC converter including a generated Windows Sysmon ruleset☆33Updated 4 years ago
- A tool that allows you to document and assess any security automation in your SOC☆46Updated 6 months ago
- The Sigma command line interface based on pySigma☆153Updated last month
- A Ruleset to enhance detection capabilities of Ossec using Sysmon☆92Updated 3 years ago
- Open source endpoint agent providing host information to Zeek. [v2]☆80Updated this week
- ☆104Updated 11 months ago
- Synthetic Adversarial Log Objects: A Framework for synthentic log generation☆81Updated last year
- ☆21Updated 3 weeks ago
- Docker image for MISP☆127Updated last month
- Sysmon and wazuh integration with Sigma sysmon rules [updated]☆65Updated 3 years ago
- SIGMA UI is a free open-source application based on the Elastic stack and Sigma Converter (sigmac)☆188Updated 4 years ago
- Splunk Content Control Tool☆112Updated this week
- Convert Sigma rules to Wazuh rules☆64Updated last year
- Threat Intelligence with Elastic - Minemeld integration with Elasticsearch☆19Updated 4 years ago
- OSSEM Detection Model☆177Updated 2 years ago
- This repository includes a mapping table and a reference process that allows converting between STIX 2.1 Course of Action objects that ma…☆16Updated 2 years ago
- The Infosec Community Definitive Guide to Jupyter Notebooks☆121Updated 4 years ago
- ☆125Updated last year
- Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise☆63Updated last year