zolderio / misp-to-sentinel
Azure function to insert MISP data in to Azure Sentinel
☆32Updated 2 years ago
Alternatives and similar repositories for misp-to-sentinel:
Users that are interested in misp-to-sentinel are comparing it to the libraries listed below
- Remote access and Antivirus Logging Database☆42Updated last year
- VelociraptorMCP is a Model Context Protocol bridge for exposing LLMs to MCP clients.☆20Updated 3 weeks ago
- ☆72Updated 6 months ago
- ☆21Updated 2 years ago
- Cumulonimbus-UAL_Extractor is a PowerShell based tool created by the Tesorion CERT team to help gather the Unified Audit Logging out of a…☆19Updated last year
- A preconfigured Velociraptor triage collector☆51Updated last week
- Velociraptor Server hosted in Azure App Service☆17Updated this week
- ☆41Updated 2 years ago
- ☆47Updated 3 weeks ago
- Collection of scripts/resources/ideas for attack surface reduction and additional logging to enable better threat hunting on Windows endp…☆38Updated last year
- Sigma detection rules for hunting with the threathunting-keywords project☆55Updated 2 months ago
- CSIRT Jump Bag☆26Updated last year
- User Feedback Space of #MitreAssistant☆37Updated last year
- Summiting the Pyramid is a research project focused on engineering cyber analytics to make adversary evasion more difficult. The research…☆38Updated last month
- A collection of various SIEM rules relating to malware family groups.☆66Updated 10 months ago
- This repository contains sample log data that were collected after running adversary simulations in Microsoft 365☆20Updated 6 months ago
- Invoke-Forensics provides PowerShell commands to simplify working with the forensic tools KAPE and RegRipper.☆114Updated last year
- ☆23Updated 8 months ago
- A collection of tips for using MISP.☆74Updated 4 months ago
- ☆34Updated 6 months ago
- TIM is a Kusto investigation platform that enables a user to quickly pivot between data sources; annotate their findings; and promotes co…☆21Updated 8 months ago
- Hunting Queries for Defender ATP☆81Updated 2 weeks ago
- ☆41Updated 3 years ago
- SigmaHQ pySigma CrowdStrike processing pipeline☆24Updated 6 months ago
- Pushes Sysmon Configs☆88Updated 3 years ago
- A project that aims to automate Volatility3 at scale with the use of cloud strength and the power of KQL inside ADX.☆16Updated 4 months ago
- Repository documenting how Threat Intelligence and / or a Threat Intelligence Platform can prove its value to an organisation.☆51Updated 6 months ago
- REST server that can analyze Kusto KQL queries against the Sentinel and Microsoft 365 Defender schemas.☆32Updated 3 months ago
- The ultimate repository for remotely deploying Crowdstrike sensors quickly and discreetly on any other EDR platform.☆23Updated last week
- A repository hosting example goodware evtx logs containing sample software installation and basic user interaction☆76Updated last year