Online resources related to Detection Engineering. Detection rules, detection logic, attack samples, detection tests and emulation tools, logging configuration and best practices, event log references, resources, labs, data manipulation online tools, blogs, newsletters, good reads, books, trainings, podcasts, videos and twitter/x accounts.
☆187Oct 22, 2026Updated last week
Alternatives and similar repositories for awesome-detection-engineer
Users that are interested in awesome-detection-engineer are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Online resources related to SOC Analysts. Incident investigation reference material, blogs, newsletters, good reads, books, trainings, po…☆95Oct 13, 2026Updated 2 weeks ago
- Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation o…☆1,379Oct 12, 2026Updated 3 weeks ago
- A framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concret…☆66Updated this week
- Repository with Hunting and Detection Queries for Microsoft Sentinel and Microsoft Defender XDR☆17Oct 17, 2026Updated 2 weeks ago
- Sigma rules to share with the community☆126Jan 29, 2025Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A starter pack of resources to help you get started in Detection Engineering.☆201Jun 4, 2026Updated 4 months ago
- ☆99Jan 7, 2026Updated 9 months ago
- Detection Reliability And Precision Efficiency (DRAPE) is an index used to assess detection performance☆36Nov 17, 2025Updated 11 months ago
- Detection engineering template☆15Jul 24, 2025Updated last year
- how to strangle threats☆70Oct 26, 2026Updated last week
- Mapping of open-source detection rules and atomic tests.☆217Jul 15, 2026Updated 3 months ago
- Sentinel Logic Apps, Playbooks and Workbooks to automate enrichment, incident analysis and more.☆125Jan 18, 2026Updated 9 months ago
- Collection of different Azure/Entra focused solutions (Deployable templates, Function Apps, etc)☆81Apr 12, 2026Updated 6 months ago
- Detection engineering with durable memory, a five-stage lifecycle, and an agentic surface — the sibling of ATHF.☆35Oct 14, 2026Updated 2 weeks ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Awesome list of keywords and artifacts for Threat Hunting sessions☆680Aug 4, 2025Updated last year
- Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).☆831Oct 21, 2026Updated last week
- ResearchDev - XDR & SIEM Detection☆66Apr 16, 2025Updated last year
- sKaleQL is an opinionated template repository for managing, executing, and organizing Kusto Query Language (KQL) queries against Azure Lo…☆21May 20, 2025Updated last year
- This repo contains all the Microsoft Sentinel content build by EightFence for the Community☆14Updated this week
- A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as …☆475Feb 18, 2026Updated 8 months ago
- Repository where I hold random detection and threat hunting queries that I come up with based on different sources of information (or eve…☆294Jun 23, 2026Updated 4 months ago
- Anvilogic Forge☆119Mar 31, 2026Updated 7 months ago
- An opensource sigma conversion tool built using pysigma☆176Updated this week
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Splunk Security Content☆1,724Updated this week
- Community-driven PowerShell detection indicators☆47Jan 27, 2026Updated 9 months ago
- Awesome Security lists for SOC/CERT/CTI☆1,956Updated this week
- This repository contains detection and threat hunting queries created by NVISO’s CSIRT and SOC teams.☆20Oct 26, 2026Updated last week
- KQL Queries. Microsoft Defender, Microsoft Sentinel☆934Updated this week
- PowerShell tools to help defenders hunt smarter, hunt harder.☆491Oct 29, 2025Updated last year
- An index of publicly available and open-source threat detection rulesets.☆141Apr 17, 2025Updated last year
- Set of SIGMA rules (>350) mapped to MITRE ATT&CK tactic and techniques☆449May 21, 2026Updated 5 months ago
- Discover how every _CL table gets its data into Microsoft Sentinel. Scans Logic Apps, Azure Functions, AMA agents, Arc machines, DCRs, an…☆12Mar 29, 2026Updated 7 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Utilizing your Threat data from a MISP instance into CarbonBlack Response by exposing the data in the Threat Intelligence Feed.☆20May 25, 2022Updated 4 years ago
- Convert Sigma rules to SIEM queries, directly in your browser.☆124Oct 24, 2026Updated last week
- Repository with supporting materials for Invictus Academy/Training☆45Jul 22, 2026Updated 3 months ago
- Repository documenting how Threat Intelligence and / or a Threat Intelligence Platform can prove its value to an organisation.☆54Oct 23, 2024Updated 2 years ago
- A small guide on Unknown/Orphaned SIDs and some PowerShell tools to help you get rid of them.☆21Apr 16, 2026Updated 6 months ago
- GitHub action for validating Microsoft Sentinel detection rules☆14May 22, 2023Updated 3 years ago
- A framework for developing alerting and detection strategies for incident response.☆925Oct 2, 2026Updated last month