Alternatives and similar repositories for hunts

Users that are interested in hunts are comparing it to the libraries listed below

• Yamato-Security / suzaku-rules
  ☆11Updated last month
• blackstork-io / fabric-templates
  Open-source Fabric templates for cybersecurity and compliance
  ☆28Updated last year
• infosecB / detection-as-code
  An example of how to deploy a Detection as Code pipeline using Sigma Rules, Sigmac, Gitlab CI, and Splunk.
  ☆59Updated 3 years ago
• center-for-threat-informed-defense / summiting-the-pyramid
  Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…
  ☆52Updated last week
• korniko98 / pivot-atlas
  ☆101Updated last month
• M3NIX / sigmaio
  simple webapp for converting sigma rules into siem queries using the pySigma library
  ☆51Updated 2 years ago
• muchdogesec / txt2stix
  Extracts IoCs, TTPs and the relationships between them. Outputs a STIX 2.1 bundle.
  ☆79Updated this week
• muchdogesec / obstracts
  Turn any blog into structured threat intelligence.
  ☆43Updated last week
• cyentific-rni / security-playbook-stix-misp-exchange
  This repository includes a mapping table and a reference process that allows converting between STIX 2.1 Course of Action objects that ma…
  ☆16Updated 3 years ago
• AttackIQ / SigmAIQ
  A pySigma wrapper and langchain toolkit for automatic rule creation/translation
  ☆90Updated 2 months ago
• BenjiTrapp / aws-threat-hunting
  Short deep dive into Threat Hunting on AWS
  ☆17Updated 2 years ago
• mattreduce / cti-self-study
  Track progress and keep notes while working through likethecoins' CTI Self Study Plan
  ☆29Updated 3 years ago
• tropChaud / Cyber-Adversary-Heatmaps
  Intelligence around common attacker behaviors (MITRE ATT&CK TTPs), in the form of ATT&CK Navigator "layer" json files.
  ☆36Updated 3 years ago
• runreveal / sigmalite
  ☆51Updated last month
• 3CORESec / Automata
  Automatic detection engineering technical state compliance
  ☆55Updated last year
• Shuffle / workflows
  Workflows for Shuffle
  ☆24Updated 3 years ago
• northsh / detection.studio
  Convert Sigma rules to SIEM queries, directly in your browser.
  ☆107Updated last month
• mgreen27 / mcp-velociraptor
  VelociraptorMCP is a Model Context Protocol bridge for exposing LLMs to MCP clients.
  ☆67Updated 4 months ago
• jshlbrd / detection-engineering-pocket-guide
  pocket guide for core detection engineering concepts
  ☆31Updated 2 years ago
• svch0stz / TheThreatHuntLibrary
  Library of threat hunts to get any user started!
  ☆45Updated 5 years ago
• cti-cmm / framework
  A new Cyber Threat Intelligence Capability Maturity Model (CTI-CMM) to empower your team and create lasting value. Inspired by Industry N…
  ☆41Updated 8 months ago
• cudeso / misp-tip-of-the-week
  A collection of tips for using MISP.
  ☆75Updated last year
• mthcht / ThreatHunting-Keywords-sigma-rules
  Sigma detection rules for hunting with the threathunting-keywords project
  ☆57Updated 10 months ago
• cudeso / dfir-iris-misp-timesketch
  Scripts to integrate DFIR-IRIS, MISP and TimeSketch
  ☆34Updated 3 years ago
• opencybersecurityalliance / kestrel-huntbook
  This repository hosts community contributed Kestrel huntflows (.hf) and huntbooks (.ipynb)
  ☆36Updated 2 years ago
• west-wind / Threat-Hunting-With-Splunk
  Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
  ☆67Updated last year
• jalacloud / mcp-cti
  Repo for experimenting and testing MCP server builds for CTI-related research.
  ☆27Updated 8 months ago
• kcyerrid / CTI
  Cyber Threat Intelligence
  ☆73Updated last month
• invictus-ir / Sigma-AWS
  This repository contains the research and components of our research into using Sigma for AWS Incident Response.
  ☆31Updated 2 years ago
• blueteam0ps / det-eng-samples
  This repository contains sample log data that were collected after running adversary simulations in Microsoft 365
  ☆23Updated last year