Set of SIGMA rules (>350) mapped to MITRE ATT&CK tactic and techniques

Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

Elastic Integrations

This repository contains sample log data that were collected after running adversary simulations in Microsoft 365

Save toil in security operations with: Detection & Intelligence Analysis for New Alerts (D.I.A.N.A. )

A fast tool to convert any website into LLM-ready markdown data. Built by https://supermemory.ai

This Cheat sheet list has been made to enhance the workflow and efficiency. This well curated list will save you time when you just can't remember the code.

Cyber Incident Response Team Playbook Battle Cards

A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.

This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services.

Tool for obfuscating and deobfuscating data.

PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform

A curated list of amazingly awesome Cybersecurity datasets

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

SIEM Tactics, Techiques, and Procedures

AzureADRecon is a tool which gathers information about the Azure Active Directory and generates a report which can provide a holistic picture of the current state of the target environment.

Mapping Corelight or Zeek data to Elastic Common Schema logs

Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...

Build & test new Matano log sources locally using your IDE 🧑‍💻

Collection of Event ID ressources useful for Digital Forensics and Incident Response

KQL queries for Incident Response

A dataset with CloudTrail events from an attack simulation using Stratus.

This repository contains the research and components of our research into using Sigma for AWS Incident Response.

Apps to be used for Shuffle automation

Machine Learning for Cyber Security

The Office 365 Extractor is a tool that allows for complete and reliable extraction of the Unified Audit Log (UAL)

Some resources to facilitate my blog on auditd for security monitoring

AtomicThreatProfile is a Python script that creates custom adversary profiles for use in Caldera using json formatted data from Control Validation Compass