817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Repository Index
47,133 repositories indexed
1–17 of 17 · Most stars
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
- kubernetes
- security
- nsa
- mitre-attack
Automated Adversary Emulation Platform
- adversary-emulation
- caldera
- security-automation
- red-team
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
- threat-hunting
- sysmon
- hunting-campaigns
- hypothesis
A repository of sysmon configuration modules
- sysmon
- dfir
- threat-hunting
- mitre-attack
Windows Events Attack Samples
- threat-hunting
- evtx
- windows-security
- mitre-attack
Security sensor for realtime threat detection and protection
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
An OpenID Connect reference implementation in Java on the Spring platform.
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
- detection-engineering
- splunk
- mitre
- awesome-list
Modular file scanning/analysis framework
- python
- analytic-machines
- analysis-framework
- python-script
Agentic memory for CTI in Python — STIX knowledge graphs, threat-actor alias resolution, offline-first RAG, MCP server for Claude Code and LangChain agents
Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation, and SIEM validation.
Cedar is a tool for testing the strength of Electronic Clinical Quality Measure (eCQM) collection systems that receive Quality Reporting Document Architecture (QRDA) files. Please email [email protected] for more information.
Sigma Queries turned into KQL for Defender using pysigma - Automated
- detection-engineering
- kql
- microsoftsentinel
- mitre-attack
TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel
- cybersecurity
- detection-engineering
- devops
- kql