sigmahq/pysigma-backend-opensearchConverts Sigma detection rules into OpenSearch Lucene and PPL queries, including alerting Monitor Rules and correlation support for SIEM detection…
sigmahq/sigma-cliThe Sigma command line interface based on pySigma
mandiant/macos-unifiedlogsParses Apple Unified Logs to extract process, thread, activity, timestamp, and message metadata from logarchives or live macOS systems into JSONL/CSV…
ion-storm/sysmon-configAdvanced Sysmon ATT&CK configuration focusing on Detecting the Most Techniques per Data source in MITRE ATT&CK, Provide Visibility into Forensic…
olafhartong/sysmon-parserGenerates and maintains Azure Sentinel parser for Sysmon events, normalizing all Windows endpoint telemetry into a searchable log schema via…
sigmahq/pysigmaPython library to parse and convert Sigma rules into queries (and whatever else you could imagine)
cobalt-strike/sleep_python_bridgeThis project is 'bridge' between the sleep and python language. It allows the control of a Cobalt Strike teamserver through python without the need…
nccgroup/mimikatz-detector-busylightUSB HID driver emulation with PID/VID (0x3bca/0x27bb) of Plenom A/S Busylight Alpha, that is supported by Mimikatz. When mimikatz is executed, a…
nccgroup/mortimerA collection of scripts for processing network forensics type data and intelligence, mainly into a postgres database.
santosomar/log4j-ioc-detectorA Simple Log4j Indicator of Compromise Linux Detector
corelight/community-id-specAn open standard for hashing network flows into identifiers, a.k.a "Community IDs".
corelight/log-add-http-post-bodiesAdd POST body excerpt to Bro's HTTP log
corelight/extendintelThis package extends the Intel package to log more fields
corelight/ecs-templatesCorelight or Zeek Elastic Common Schema Templates
acquiredsecurity/forensic-timelinerA high-speed forensic timeline engine for Windows forensic artifact CSV output built for DFIR investigators. Quickly consolidate CSV output from…
twocanoes/auditAudit Preference Pane and Log Reader for OS X
