tenzir
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
incident-responselog-analysisnetwork-security+1
757
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
d3vhex/sentoraAn open-source, self-hosted AI-powered SIEM, EDR and SOAR platform for modern security operations.
beenuar/aisocOpen-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation.…
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
zedocun/sharepoint-cve-2023-29375-incident-responseEnd-to-end SOC incident analysis and threat hunting playbook targeting Microsoft SharePoint privilege escalation (CVE-2023-29375) using SIEM logs,…
securityclaw/securityclawA modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…
manishrawat21/detection-rulesThis repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual…
ptd200110/cve-2024-27198-soc-labSOC detection and incident response lab simulating CVE-2024-27198 authentication bypass in JetBrains TeamCity. Includes ELK SIEM, Suricata IDS, Sigma…
g0thamrabb1t/cve-2026-48907-joomla-jce-detectionDefensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, webshell…
nate-ryan-7690/home_soc_suiteA personal Windows SOC suite built in PowerShell — monitors network connections, resource usage, scheduled tasks and power events with severity…
pedrofbrm/apache-web-log-analysis-labBlue Team lab focused on analyzing Apache web access logs to detect directory brute forcing and web scanning activity.
manishrawat21/analysisHands-on analysis of common APT attack techniques, focused on how they show up in logs and how defenders can realistically detect them.
ashok523/cve-2026-31431Defensive IR playbook and detection package for CVE-2026-31431 (Copy Fail) Linux kernel LPE, including Sigma, auditd, Falco, Wazuh, YARA, eBPF, and…
mithileshan/soc-investigation-labEnd-to-end SOC investigation: CVE-2011-2523 kill chain, multi-source log correlation, incident report — MITRE ATT&CK T1190
zedocun/pan-os-cve-2024-3400-command-injection-investigationInvestigation of a PAN-OS CVE-2024-3400 command injection attempt, analyzing payload delivery, internal processing, and execution validation based on…
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…
cross-samuel1/soc-analyst-hubFree, offline SOC Analyst Hub for Tier 1 — IR checklists, alert triage playbooks, threat hunting queries & analyst onboarding. Single HTML file, no…