Alternatives and similar repositories for elastic-m365

Users that are interested in elastic-m365 are comparing it to the libraries listed below

• PwC-IR / MIA-MailItemsAccessed-
  Tool to extract Sessions, MessageID(s) and find the emails belonging to MessageID(s). This script utilizes the MailItemsAccessed features…
  ☆41Updated 4 years ago
• invictus-ir / Blue-team-app-Office-365-and-Azure
  ☆72Updated 6 months ago
• Starke427 / Windows-Security-Policy
  Specific guidance and configuration scripts based on Microsoft-recommended security configuration baselines for Windows.
  ☆13Updated 4 years ago
• mdecrevoisier / Windows-auditing-baseline
  Provides an advanced baseline to implement a secure Windows auditing strategy on Windows OS.
  ☆54Updated 4 months ago
• humio / security_monitoring
  ☆41Updated 2 years ago
• zolderio / misp-to-sentinel
  Azure function to insert MISP data in to Azure Sentinel
  ☆32Updated 2 years ago
• FalconForceTeam / KQLAnalyzer
  REST server that can analyze Kusto KQL queries against the Sentinel and Microsoft 365 Defender schemas.
  ☆33Updated 3 months ago
• MHaggis / ASRGEN
  ASR Configurator, Essentials and Atomic Testing
  ☆40Updated last month
• alexverboon / DefenderResourceHub
  Defender Resource Hub
  ☆23Updated last month
• Truvis / Sentinel
  ☆29Updated 2 weeks ago
• 0xAnalyst / DefenderATPQueries
  Hunting Queries for Defender ATP
  ☆81Updated last month
• olafhartong / WDACme
  A WDAC configuration repository with the sole intention of enriching MDE
  ☆28Updated 2 years ago
• joeavanzato / ThreatSim
  Threat Simulator for Enterprise Networks
  ☆14Updated 3 years ago
• olafhartong / DefenderHarvester
  Expose a lot of MDE telemetry that is not easily accessible in any searchable form
  ☆106Updated 5 months ago
• THEVER1TAS / sysmon-config
  Sysmon configuration file templates with advanced event tracing and blocking
  ☆40Updated last month
• reprise99 / mddrguidance
  Links and guidance related to the return on mitigation report in the Microsoft Digital Defense Report
  ☆28Updated last year
• mdecrevoisier / Windows-WEC-server_auto-deploy
  PowerShell scripts for fast Windows Event Collector configuration with Palantir toolset
  ☆22Updated 2 years ago
• ScarredMonk / PopulateActiveDirectory
  Powershell script to build active directory forest and populate AD with random AD objects including AD users objects, computers objects, …
  ☆35Updated 3 years ago
• Trimarc / Invoke-TrimarcADChecks
  The Invoke-TrimarcADChecks.ps1 PowerShell script is designed to gather data from a single domain AD forest based on our similar checks pe…
  ☆51Updated last year
• alexverboon / SentinelTIUploadToolkit
  Sentinel Threat Intelligence Upload Toolkit
  ☆13Updated 10 months ago
• msdirtbag / azurevelo
  Velociraptor Server hosted in Azure App Service
  ☆42Updated last week
• cylaris / awesomekql
  Microsoft Sentinel, Defender for Endpoint - KQL Detection Packs
  ☆53Updated last year
• mr-r3b00t / KQL
  This is for my crappy (but hopefully useful) MDE and Sentinel KQL queries! #KQLThePlanet
  ☆12Updated 2 months ago
• AttacktheSOC / Azure-SecOps
  Collection of different Azure/Entra focused solutions (Deployable templates, Function Apps, etc)
  ☆66Updated last month
• jischell-msft / RemoteManagementMonitoringTools
  Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations
  ☆88Updated 9 months ago
• swiftbird07 / IRIS-SOAR
  🚀 IRIS-SOAR: Modular SOAR (Security Orchestration, Automation, and Response) implementation in Python. Designed to complement DFIR-IRIS …
  ☆10Updated last year
• msdirtbag / ADXFlowmaster
  ADXFlowmaster helps SecOps teams Threat Hunt suspicious network traffic inside & outside of Azure.
  ☆36Updated 6 months ago
• ugurkocde / KQL-Search
  ☆30Updated last year
• Spicy-Toaster / ActiveDirectory-Tiering
  Scripts and a short guide for using them to tier an Active Directory. Made for BSides Copenhagen 2024
  ☆38Updated 6 months ago
• JeffMichelmore / MDEKit
  ☆41Updated last year