endgameinc / eqlLinks
☆222Updated last year
Alternatives and similar repositories for eql
Users that are interested in eql are comparing it to the libraries listed below
Sorting:
- ☆165Updated 4 years ago
- Open-source framework to detect outliers in Elasticsearch events☆209Updated 2 years ago
- This project is no longer maintained. There's a successor at https://github.com/zeek/zeek-agent-v2☆123Updated 4 years ago
- Django web interface for managing Yara rules☆194Updated 7 years ago
- Parse YARA rules and operate over them more easily.☆191Updated 7 months ago
- Mapping NSM rules to MITRE ATT&CK☆72Updated 5 years ago
- Data from a BRAWL Automated Adversary Emulation Exercise☆209Updated 4 years ago
- Log Entry to Sigma Rule Converter☆109Updated 3 years ago
- Knowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL) (ALPHA STATE AT THE MOMENT)☆103Updated 2 months ago
- A Python library to help with some common threat hunting data analysis operations☆143Updated 2 years ago
- Definition, description and relationship types of MISP objects☆100Updated this week
- ☆132Updated 4 years ago
- A lightweight tool to load Windows Event Log evtx files into Elasticsearch.☆119Updated 4 years ago
- Security ML models encoded as Yara rules☆213Updated 2 years ago
- A tool to extract structured cyber information from incident reports.☆80Updated 7 years ago
- Deception based detection techniques mapped to the MITRE’s ATT&CK framework☆289Updated 7 years ago
- A Python package to interact with the Mitre ATT&CK Framework☆477Updated last year
- Threat Report ATT&CK™ Mapping (TRAM) is a tool to aid analyst in mapping finished reports to ATT&CK.☆353Updated 3 years ago
- SIGMA UI is a free open-source application based on the Elastic stack and Sigma Converter (sigmac)☆189Updated 4 years ago
- ☆34Updated 5 years ago
- Threat Alert Logic Repository☆92Updated 6 years ago
- CASCADE Server☆272Updated 2 years ago
- OASIS Cyber Threat Intelligence (CTI) TC Open Repository: Convert STIX 1.2 XML to STIX 2.x JSON☆51Updated last year
- OASIS TC Open Repository: Match STIX content against STIX patterns☆45Updated 3 years ago
- An open source framework for enterprise level automated analysis.☆395Updated 3 years ago
- Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security relate…☆168Updated last year
- OASIS TC Open Repository: Non-normative schemas and examples for STIX 2☆127Updated 2 months ago
- ☆175Updated last year
- stoQ Public Plugins☆71Updated 2 years ago
- OASIS TC Open Repository: TAXII 2 Client Library Written in Python☆116Updated last year