content-packs
eventum-generator/content-packsContent packs for Eventum
utilities-frameworksthreat-intelligenceeducation+2
520 days ago
Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
eventum-generator/content-packsContent packs for Eventum
sreckoskocilic/envocabularyTrace every shell environment variable to its exact file and line origin. Audit shell configs for dead entries, duplicates, and orphaned files across…
zephrfish/ludus-defender-labMDE/MDI Defender setup for Ludus
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
ctrlaltint3l/intelligenceCentralized repository for malware samples, threat intelligence, IOCs, and security tooling logs to support threat research and incident response…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
zedocun/sharepoint-cve-2023-29375-incident-responseEnd-to-end SOC incident analysis and threat hunting playbook targeting Microsoft SharePoint privilege escalation (CVE-2023-29375) using SIEM logs,…
chpratik/cve-2026-54121Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
target/strelka-uiStrelka Web UI for File Submission and Analysis
j-dahl7/mcp-attack-detection-sentinelSentinel detection lab for MCP attack chains: CVE-2026-26118 SSRF token theft, tool poisoning, cross-server exfiltration, identity post-exploitation.…
josevnz/suricatalogParse, filter, and visualize Suricata eve.json logs with CLI tools for alerts, flows, DNS, and payloads. Includes a tutorial for learning Suricata…
lukehebe/kql-hunting_and_detection-queriesSome of my KQL hunting queries
sigmahq/pysigma-backend-opensearchConverts Sigma detection rules into OpenSearch Lucene and PPL queries, including alerting Monitor Rules and correlation support for SIEM detection…
neo23x0/loki-rs🐍 High-performance, multi-threaded YARA & IOC scanner
1-bit-wonder/kestrelSingle-host runtime-security dashboard on eBPF — Go agent + SvelteKit. Live process tree, network map, and rule-based alerts for plain Linux hosts.
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs