elastic / security-action-examples
This repository contains a few examples of actions that can be added to rules within Elastic Security.
☆22Updated last week
Alternatives and similar repositories for security-action-examples:
Users that are interested in security-action-examples are comparing it to the libraries listed below
- Mapping Corelight or Zeek data to Elastic Common Schema fields☆34Updated last week
- Converts Netwitness log parser configuration to Logstash configuration☆20Updated 4 years ago
- Translate an ECS mapping CSV to starter pipelines for Beats, Elasticsearch or Logstash☆54Updated 2 years ago
- SIEM Logstash parsing for more than hundred technologies☆183Updated this week
- ☆93Updated 2 years ago
- Technical add-on for Splunk related to TheHive/Cortex from TheHive project☆52Updated 2 weeks ago
- SIEGMA - Transform Sigma rules into SIEM consumables☆146Updated last year
- Dettectinator - The Python library to your DeTT&CT YAML files.☆108Updated last month
- OSSEM Detection Model☆175Updated 2 years ago
- Parse wazuh[HIDS] alerts into ECS mapping using Filebeat☆27Updated 4 years ago
- Threat Intelligence with Elastic - Minemeld integration with Elasticsearch☆19Updated 3 years ago
- A collection of Cortex Analyzers and Responders for TheHive/Cortex☆13Updated 5 years ago
- The Infosec Community Definitive Guide to Jupyter Notebooks☆121Updated 4 years ago
- This is a repository of vendor-agnostic workflows provided for those interested in deploying Security Orchestration, Automation, and Resp…☆80Updated 3 years ago
- Open source endpoint agent providing host information to Zeek. [v2]☆75Updated 3 months ago
- ☆83Updated last month
- A community event for security researchers to share their favorite notebooks☆107Updated last year
- OSSEM Common Data Model☆55Updated 2 years ago
- ☆123Updated last year
- Splunk Content Control Tool☆98Updated this week
- Synthetic Adversarial Log Objects: A Framework for synthentic log generation☆78Updated last year
- Collaborative Open Playbook Standard☆153Updated last year
- This package allows the use of a custom Elastalert Alert which creates alerts with observables in TheHive using TheHive4Py.☆27Updated 3 years ago
- OSSEM Data Dictionaries☆59Updated 3 weeks ago
- ☆131Updated 10 months ago
- Ansible playbook for installing MineMeld on Linux☆48Updated 3 years ago
- A tool that allows you to document and assess any security automation in your SOC☆45Updated 3 months ago
- The principal objective of this project is to develop a knowledge base of the tactics, techniques, and procedures (TTPs) used by insiders…☆142Updated 5 months ago
- Threat Hunting & Incident Investigation with Osquery☆204Updated 2 years ago
- A Sigma to Wazuh / OSSEC converter including a generated Windows Sysmon ruleset☆33Updated 4 years ago