Repository Index

Main Sigma Rule Repository

• security
• monitoring
• siem
• logging

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

Splunk Security Content

• splunk
• detection
• engineering
• responses

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

• aws
• cloud
• security
• big-data

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Splunk code (SPL) for serious threat hunters and detection engineers.

• splunk
• threat-hunting
• use-case
• siem

Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

• ebpf
• security
• linux-kernel
• linux-security-module

:mailbox: The Phishing Intelligence Engine - An Active Defense PowerShell Framework for Phishing Defense with Office 365

Anvilogic Forge

• detection
• detection-engineering
• threat-hunting
• snowflake

OPNSense's Suricata IDS/IPS Detection Rules Against NMAP Scans

• crowdsec
• intrusion-detection
• intrusion-detection-system
• intrusion-prevention

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

Advanced Phishing Protection: Suricata rulesets open and free

• anti-phishing
• antiphishing
• openphish
• phishing

Sigma Queries turned into KQL for Defender using pysigma - Automated

• detection-engineering
• kql
• microsoftsentinel
• mitre-attack

TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel

• cybersecurity
• detection-engineering
• devops
• kql

Real-time monitoring and visualization of failed SSH login attempts on a Linux server.

Deep network visibility, powered by Suricata. Artica integrates the Suricata IDS engine directly inside your server, giving you enterprise-grade intrusion detection without the complexity. Monitor every packet in real time, detect advanced threats, and visualize malicious

• appliance
• network-monitoring
• suricata