opensearch-project / security-analytics
Security Analytics enables users for detecting security threats on their security event log data. It will also allow them to modify/tailor the pre-packaged solution.
☆82Updated this week
Alternatives and similar repositories for security-analytics
Users that are interested in security-analytics are comparing it to the libraries listed below
Sorting:
- ☆21Updated last month
- Open source endpoint agent providing host information to Zeek. [v2]☆80Updated this week
- ☆32Updated 5 months ago
- This repo contains example of raw event examples and possible translations to the OCSF schema.☆38Updated 3 weeks ago
- ☆23Updated last week
- Workflows for Shuffle☆22Updated 2 years ago
- An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.☆153Updated 2 months ago
- ☆19Updated 3 years ago
- Roota is a public-domain language of threat detection and response that combines native queries from a SIEM, EDR, XDR, or Data Lake with …☆127Updated 9 months ago
- A standard for reducing log volume without sacrificing analytical capability☆204Updated 2 months ago
- A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.☆73Updated last year
- Apps to be used for Shuffle automation. Most of Shuffle's apps (2500+) are generated from APIs, and available in the search engine below:☆110Updated last month
- ☆43Updated 2 months ago
- The Sigma command line interface based on pySigma☆153Updated last month
- pySigma backend for generating Grafana Loki/LogQL rules☆45Updated 2 weeks ago
- Helm charts for running open source digital forensic tools in Kubernetes☆94Updated 2 weeks ago
- Sigma rule specification☆134Updated 2 months ago
- Anvilogic Forge☆103Updated last week
- ☆73Updated last month
- OSSEM Common Data Model☆55Updated 2 years ago
- OCSF Documentation☆129Updated last week
- Docker image for MISP☆127Updated last month
- ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit l…☆162Updated 2 months ago
- ☆15Updated last year
- SIEGMA - Transform Sigma rules into SIEM consumables☆149Updated 2 months ago
- Translate an ECS mapping CSV to starter pipelines for Beats, Elasticsearch or Logstash☆54Updated 3 years ago
- An application allowing users to explore, create, annotate, and share extensions of the MITRE ATT&CK® knowledge base. This repository con…☆46Updated 2 weeks ago
- A library of Incident Response notebooks using Jupyter. We will show how you can leverage pre-defined notebook files to guide your incide…☆147Updated last year
- Save toil in security operations with: Detection & Intelligence Analysis for New Alerts (D.I.A.N.A. )☆181Updated 8 months ago
- The MITRE Security Automation Framework (SAF) Command Line Interface (CLI) brings together applications, techniques, libraries, and tools…☆150Updated last week