Repository Index

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

• awesome
• awesome-list
• threat-hunting
• security

No description provided by the repository host.

• threat-detection
• threat-hunting

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)

• ai-agent
• autonomous-agents
• blue-team
• cybersecurity

Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.

• detection-engineering
• splunk
• mitre
• awesome-list

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.

• agent-security
• ai-security
• llm-security
• mcp-security

A curated list of resources about detecting threats and defending Kubernetes systems.

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

🛡️ Free AI that blocks hackers while you sleep. Runs on cheap hardware. When someone in Tokyo gets attacked, you're protected in 30 seconds. No fees. No experts needed. Just protection. One node's detection → everyone's protection.

• ai-security
• cybersecurity
• ids
• iot-security

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Advanced Phishing Protection: Suricata rulesets open and free

• anti-phishing
• antiphishing
• openphish
• phishing

Self-hosted 4D spatiotemporal AI platform built on PostgreSQL, PostGIS, TimescaleDB, H3 and pgvector, with anomaly & threat detection, NLQ interface and full observability.

• ai-platform
• anomaly-detection
• h3
• nlq

Sigma Queries turned into KQL for Defender using pysigma - Automated

• detection-engineering
• kql
• microsoftsentinel
• mitre-attack