op7ic / amphuntLinks
This repository contains advanced threat hunting scripts for Cisco Secure Endpoint API. The scripts leverage the AMP API to hunt for threats, analyze endpoint behavior, and detect potential compromises across the environment using API version 0 and 1.
☆14Updated 2 weeks ago
Alternatives and similar repositories for amphunt
Users that are interested in amphunt are comparing it to the libraries listed below
Sorting:
- PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.☆38Updated 3 years ago
- Incident Response Network Tools☆24Updated 3 years ago
- PowerShell Memory Pulling script☆19Updated 10 years ago
- Splunk Add-on for PowerShell provides field extraction for PowerShell event logs.☆17Updated 4 years ago
- ☆13Updated 5 years ago
- THOR MITRE ATT&CK Framework Coverage☆24Updated 5 years ago
- Defence Against the Dark Arts☆34Updated 5 years ago
- A simple ReST server to lookup threat actors (by name, synonym or UUID) and returning the corresponding MISP galaxy information about the…☆48Updated last year
- Triage automation for suspect URLs☆13Updated 5 years ago
- Threat intelligence and threat detection indicators (IOC, IOA)☆52Updated 4 years ago
- Build your own threat hunting maturity model☆11Updated 7 years ago
- Docker Container to deploy Mitre Caldera Automated Adversary Emulation System☆26Updated 4 years ago
- incident response scripts☆19Updated 6 years ago
- Threat Hunter's Knowledge Base☆22Updated 3 years ago
- Wrap any binary into a cached webserver☆53Updated 3 years ago
- ☆39Updated 5 years ago
- An extendable tool to extract and aggregate IoCs from threat feeds☆33Updated last year
- automate your MISP installs☆68Updated 5 years ago
- Create alerts in The Hive from your Graylog alerts, to be turned into Hive cases.☆44Updated 4 years ago
- A collection of hunting and blue team scripts. Mostly others, some my own.☆37Updated 2 years ago
- ☆28Updated last week
- The "DFUR" Splunk application and data that was presented at the 2020 SANS DFIR Summit.☆12Updated 4 years ago
- MasterParser is a simple, all-in-one, digital forensics artifact parser☆23Updated 4 years ago
- Use DNS to hunt for threats including DGAs☆15Updated 9 years ago
- A script to assist in processing forensic RAM captures for malware triage☆27Updated 4 years ago
- Integrating Sysinternals Autoruns’ logs into Security Onion☆31Updated last year
- This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.☆34Updated 6 years ago
- Searches for Insider Threat Hunting☆32Updated 6 years ago
- Information about most important hunts which can be performed by Threat hunters while searching for any adversary/threats inside the orga…☆15Updated 6 years ago
- This repository was created to aid in the deployment/maintenance of the Sysmon service on a large number of computers.☆82Updated 2 years ago