Repository Index

SQL powered operating system instrumentation, monitoring, and analytics.

• security
• monitoring
• intrusion-detection
• sql

Main Sigma Rule Repository

• security
• monitoring
• siem
• logging

Linux Runtime Security and Forensics using eBPF

• ebpf
• linux
• bpf
• security

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

Database security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.

• encryption-server
• encryption
• crypto
• cryptography

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Linux Security and Monitoring Scripts

Quantum Insert

• quantum-insert
• python
• detection
• pcap

analyze a web-based network traffic 🕶 to detect central command and control servers

• squid
• network-traffic
• proxy-server
• incident-response

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

Real-time network traffic analysis in your terminal.

• cli
• ddos
• ddos-detection
• go

Sigma Queries turned into KQL for Defender using pysigma - Automated

• detection-engineering
• kql
• microsoftsentinel
• mitre-attack

TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel

• cybersecurity
• detection-engineering
• devops
• kql

The repository host gives no description.

Sigma Queries turned into SPL for Splunk Enterprise and Enterprise Security using pysigma - Automated