Repository Index

Splunk code (SPL) for serious threat hunters and detection engineers.

• splunk
• threat-hunting
• use-case
• siem

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Collection of malware persistence and hunting information. Be a persistent persistence hunter!

• threat-hunting
• threat-intelligence
• persistence
• malware-persistence

Suricata rules for network anomaly detection

• suricata-rule
• suricata
• ids
• nsm

Anvilogic Forge

• detection
• detection-engineering
• threat-hunting
• snowflake

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents

• claude-code
• cti
• llm
• rag

PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.

• powershell
• powershell-module
• grr
• incident-response

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation, and SIEM validation.

• cybersecurity
• docker
• fastapi
• llm

Sigma Queries turned into KQL for Defender using pysigma - Automated

• detection-engineering
• kql
• microsoftsentinel
• mitre-attack

TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel

• cybersecurity
• detection-engineering
• devops
• kql

Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.

• bpf
• ebpf
• forensics
• goroutine