Provides an advanced input.conf file for Windows and 3rd party related software with more than 70 different event log mapped to the MITRE Att&CK
☆94Jun 28, 2025Updated 8 months ago
Alternatives and similar repositories for Splunk-input-windows-baseline
Users that are interested in Splunk-input-windows-baseline are comparing it to the libraries listed below
Sorting:
- RBA is Splunk's method to aggregate low-fidelity security events as interesting observations tagged with security metadata to create high…☆63Feb 23, 2026Updated last week
- Collection of Dashboards for Threat Hunting and more!☆74Oct 17, 2020Updated 5 years ago
- Cyences App (Cyber Defense) built by CrossRealms International - https://splunkbase.splunk.com/app/5351/☆11Feb 27, 2026Updated last week
- Splunk code (SPL) for serious threat hunters and detection engineers.☆290Jan 15, 2024Updated 2 years ago
- A PowerShell script to prevent Sysmon from writing its events☆16Apr 23, 2020Updated 5 years ago
- DNS Dashboard for hunting and identifying beaconing☆16Jul 29, 2020Updated 5 years ago
- This repository contains Splunk queries to hunt some anomalies☆46Jul 28, 2022Updated 3 years ago
- Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.☆612Dec 8, 2025Updated 2 months ago
- Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...☆1,088Nov 8, 2025Updated 3 months ago
- Provides an advanced baseline to implement a secure Windows auditing strategy on Windows OS.☆63Feb 22, 2026Updated last week
- The purpose of this project is to publish and maintain the deployment PowerShell script that automates deployments for Active Directory C…☆258Nov 24, 2023Updated 2 years ago
- This repository is a comprehensive collection of resources, documentation, apps, and add-ons related to Splunk, a powerful data analytics…☆24Feb 16, 2026Updated 2 weeks ago
- Bring runZero Exposure Management into BloodHound☆44Nov 19, 2025Updated 3 months ago
- Splunk Security Content☆1,576Feb 26, 2026Updated last week
- ☆34Aug 8, 2023Updated 2 years ago
- Documentation and scripts to properly enable Windows event logs.☆672Oct 3, 2025Updated 5 months ago
- A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data int…☆2,445Feb 24, 2026Updated last week
- Kerberoast Detection Script☆30Oct 31, 2024Updated last year
- Simulation of Akira Ransomware with Invoke-AtomicTest☆18Jul 10, 2024Updated last year
- ☆21Updated this week
- A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID☆577Dec 6, 2025Updated 3 months ago
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆786Feb 22, 2026Updated last week
- The Github project for The Defender's Guide by Luke Paine and Jonathan Johnson☆159Jun 15, 2023Updated 2 years ago
- Timeline of Active Directory changes with replication metadata☆520Mar 21, 2025Updated 11 months ago
- M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response ca…☆323Oct 12, 2025Updated 4 months ago
- Mishky's AD Range & The Escalation Path from Hell, Version 1.1☆11May 7, 2025Updated 9 months ago
- Some Threat Hunting queries useful for blue teamers☆132May 13, 2022Updated 3 years ago
- Detect Tactics, Techniques & Combat Threats☆2,264Jan 21, 2026Updated last month
- A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you com…☆181May 27, 2025Updated 9 months ago
- Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise☆68Apr 29, 2024Updated last year
- A repository of curated datasets from various attacks☆726Feb 26, 2026Updated last week
- Automation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.☆489Nov 21, 2024Updated last year
- Helper script for BloodHound to automatically add relationships between multiple accounts owned by the same individual☆14Jul 13, 2022Updated 3 years ago
- Best practice configuration for Linux auditd for CIS and STIG standards, enhanced with LOTL detection rules.☆14Dec 6, 2025Updated 3 months ago
- ☆11Apr 2, 2022Updated 3 years ago
- snake-core - the real snake☆15Jul 11, 2023Updated 2 years ago
- ☆15Oct 29, 2024Updated last year
- Postfix Add-on for Splunk (Compliant with the Mail CIM model)☆11Mar 18, 2021Updated 4 years ago
- CRACK AND CHECK HASH TYPES IN BULK☆13Jul 28, 2021Updated 4 years ago