matano
matanolabs/matanoOpen source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
cloud-securityincident-responselog-analysis+1
1.7k
matanolabs/matanoOpen source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
jonrau1/electriceyeElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting…
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
withsecurelabs/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
cyberark/ketshashA little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.
jay123anta/laravel-threat-detectionPassive Laravel middleware that detects and logs SQL injection, XSS, RCE, bot scanners, and 175+ attack patterns. Features a built-in dashboard,…
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
ahmedkhlief/apt-hunterAPT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…
eshlomo1/microsoft-sentinel-secopsSOC operations content for Microsoft Sentinel, including hunting queries, incident response playbooks, and security event analysis for Azure cloud…
jepaynemsft/wefflesBuild a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
mthbernardes/artlasApache Real Time Logs Analyzer System
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
hybridbrothers/hunting-queries-detection-rulesThe purpose of this repository is to share KQL queries to help identify security misconfigurations, hunt for specific patterns, or detect malicious…
withsecurelabs/detectreeInteractive data visualization tool for blue teams to analyze detection data, understand relationships, reduce alert fatigue, and improve incident…
romaissaadjailia/get-applockereventlogThis is a repo for fetching Applocker event log by parsing the win-event log
certat/citrix-logcheckerParse citrix netscaler logs to check for signs of CVE-2023-4966 exploitation
zedocun/pan-os-cve-2024-3400-command-injection-investigationInvestigation of a PAN-OS CVE-2024-3400 command injection attempt, analyzing payload delivery, internal processing, and execution validation based on…