finackninja / CSFRTRLinks
A collection of scripts for use with CrowdStrike Falcon RTR
☆17Updated last year
Alternatives and similar repositories for CSFRTR
Users that are interested in CSFRTR are comparing it to the libraries listed below
Sorting:
- Tools for simulating threats☆197Updated 2 years ago
- A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation☆77Updated last year
- ☆81Updated last year
- A collection of various SIEM rules relating to malware family groups.☆70Updated last year
- ☆74Updated last year
- MISP to Sentinel integration☆75Updated 2 weeks ago
- Repository of attack and defensive information for Business Email Compromise investigations☆268Updated 6 months ago
- ☆104Updated 4 months ago
- ☆42Updated last year
- SPL cheatsheet for Splunk.☆24Updated 2 years ago
- Conference presentations☆60Updated 3 weeks ago
- Repository of SentinelOne Deep Visibility queries.☆134Updated 4 years ago
- ☆66Updated 2 years ago
- Threat Hunting Toolkit is a Swiss Army knife for threat hunting, log processing, and security-focused data science☆145Updated 2 weeks ago
- A repository to share publicly available Velociraptor detection content☆190Updated this week
- Collection of Remote Management Monitoring tool artifacts, for assisting forensics and investigations☆98Updated 2 months ago
- ☆45Updated 3 years ago
- InsightVM helpful SQL queries☆75Updated 8 months ago
- VirtualGHOST Detection Tool☆96Updated last year
- Unleash the power of the Falcon Platform at the CLI☆132Updated last month
- SigmaHQ pySigma CrowdStrike processing pipeline☆26Updated 2 months ago
- SentinelOne STAR Rules☆69Updated 9 months ago
- A preconfigured Velociraptor triage collector☆56Updated this week
- Collection of scripts/resources/ideas for attack surface reduction and additional logging to enable better threat hunting on Windows endp…☆38Updated last year
- A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.☆159Updated 7 months ago
- Incident Response documents and tooling☆108Updated 2 months ago
- Provides an advanced input.conf file for Windows and 3rd party related software with more than 70 different event log mapped to the MITRE…☆93Updated 4 months ago
- RRR (Rapid Response Reporting) is a collection of Incident Response Report objects. They are designed to help incident responders provid…☆37Updated 3 years ago
- A PowerShell incident response script for quick triage☆81Updated 3 years ago
- MITRE ATT&CK mapped queries for SentinelOne Deep Visiblity☆92Updated 4 years ago