Repository Index

Automated Adversary Emulation Platform

• adversary-emulation
• caldera
• security-automation
• red-team

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis

Modular file scanning/analysis framework

• python
• analytic-machines
• analysis-framework
• python-script

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

• claude-code
• cti
• llm
• rag

Sigma Queries turned into KQL for Defender using pysigma - Automated

• detection-engineering
• kql
• microsoftsentinel
• mitre-attack