MasterParser
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
digital-forensicseducationforensics+3
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
letsdefend/awesome-soc-analystUseful resources for SOC Analyst and SOC Analyst candidates.
swimlane/soc-fakerA python package for use in generating fake data for SOC and security automation.
g0thamrabb1t/cve-2026-48907-joomla-jce-detectionDefensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, webshell…
ashok523/cve-2026-31431Defensive IR playbook and detection package for CVE-2026-31431 (Copy Fail) Linux kernel LPE, including Sigma, auditd, Falco, Wazuh, YARA, eBPF, and…
ptd200110/cve-2024-27198-soc-labSOC detection and incident response lab simulating CVE-2024-27198 authentication bypass in JetBrains TeamCity. Includes ELK SIEM, Suricata IDS, Sigma…
manishrawat21/analysisHands-on analysis of common APT attack techniques, focused on how they show up in logs and how defenders can realistically detect them.
zedocun/sharepoint-cve-2023-29375-incident-responseEnd-to-end SOC incident analysis and threat hunting playbook targeting Microsoft SharePoint privilege escalation (CVE-2023-29375) using SIEM logs,…
0x0allenace/soc-analyst-portfolioA curated portfolio showcasing my SOC investigations, threat hunting projects, DFIR labs, detection engineering, technical blogs, and cybersecurity…
nktris/htsocReproducible SOC lab for CVE-2024-4577 detection and response
cyberbibs/soc274---palo-alto-networks-pan-os-command-injection-vulnerability-exploitation-cve-2024-3400-Step-by-step SOC analyst walkthrough for investigating and remediating CVE-2024-3400 (PAN-OS command injection). Covers detection, log analysis,…
deividasterechovas/soc227-microsoft-sharepoint-server-elevation-of-privilege-possible-cve-2023-29357-exploitationSOC case analysis walkthrough demonstrating detection and response to CVE-2023-29357 privilege escalation in Microsoft SharePoint Server, including…
mthcht/threathunting-keywordsAwesome list of keywords and artifacts for Threat Hunting sessions
safelineman/agentic-soc-simulationAI 驱动的 SOC 仿真平台
nate-ryan-7690/home_soc_suiteA personal Windows SOC suite built in PowerShell — monitors network connections, resource usage, scheduled tasks and power events with severity…
shakur1314/cve-2022-22965-spring4shell-security-operations-analysisA comprehensive Security Operations Centre (SOC) incident response simulation demonstrating threat detection, triage, analysis, and mitigation of the…
securityclaw/securityclawA modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…
justjeff211/conti-ransomware-writeupConducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows…