awesome-detection-engineering

The foundational framework of adversary tactics, techniques, and procedures based on real-world observations

Alerting and Detection Strategies (ADS) Framework | Palantir

A blueprint for creating and documenting effective detection content

A detailed matrix that serves as a tool to measure the overall maturity of an organization's Detection Engineering program

Defines and describes 8 different levels of an organization's threat detection program maturity

A model used to describe various categorizations of indicator's of compromise and their level of effectiveness in detecting threat actors

Lockheed Martin's framework that outlines the 7 stages commonly observed in a cyber attack

A business-centric approach for defining threat detection use cases

Synthetic Adversarial Log Objects (SALO) | Splunk

Synthetic Adversarial Log Objects (SALO) is a framework for the generation of log events without the need for infrastructure or actions to initiate the event that causes a log event

Outlines 19 aphorisms that serve as universal principles for the creation of high quality detection content

Blue-Team-as-Code: Lessons From Real-world Red Team Detection Automation Using Logs

Snowflake’s implementation of the Detection Development Lifecycle

A maturity matrix to measure the success of your threat detection program

Elastic's qualitative and quantitative approach to measuring threat detection program maturity

A longtime detection engineer outlines how a detection engineering program should be built from the ground up

MITRE's well-maintained repository of detection content

A matrix of MITRE ATT&CK technique IDs and links to available Splunk Security Content, Elastic detection rules, Sigma rules, and CAR content

Sigma Rules

Sigma's repository of turnkey detection content. Content can be converted for use with most SIEMs

An opensource tool that can convert detection content for use with most SIEMs

Splunk Security Content

Splunk's open-source and frequently updated detection content that can be tweaked for use in other tools

Elastic Detection Rules

Elastic's detection rules written natively for the Elastic SIEM. Can easily be converted for use by other SIEMs using Uncoder

Elastic Endpoint Behavioral Rules

Elastic's endpoint behavioral (prevention) rules written in EQL, natively for the Elastic endpoint agent

Elastic Yara Signatures

Elastic's YARA signatures, which run on the Elastic endpoint agent

Elastic Endpoint Ransomware Artifact

Elastic's ranswomware artifact, which runs on the Elastic endpoint agent

Chronicle (GCP) Detection Rules

Chronicle's detection rules written natively for the the Chronicle Platform

Exabeam Content Library

Exabeam's out of the box detection content compatible with the Exabeam Common Information Model

Panther Labs Detection Rules

Panther Lab's native detection rules

Anvilogic Detection Armory

Anvilogic's opensource and publicly available detection content

A list of all AWS GuardDuty Findings, their descriptions, and associated data sources

A list of all GCP Security Command Center Findings, their descriptions, and associated data sources

A list of all Azure Security for Cloud Alerts, their descriptions, and associated data sources

Center for Threat Informed Defense Security Stack Mappings

Describes cloud computing platform's (Azure, AWS) built-in detection capabilities and their mapings to the MITRE ATT&CK framework

Detection Engineering with Splunk

A GitHub repo dedicated to sharing detection analytics in SPL

Google Cloud Security Analytics

This repository serves as a community-driven list of sample security analytics for auditing cloud usage and for detecting threats to your data & workloads in Google Cloud

KQL Advanced Hunting Queries & Analytics Rules

A list of endpoint detections and hunting queries for Microsoft Defender for Endpoint, Defender For Identity, and Defender For Cloud Apps

Multiple cheatsheets outlined recommendations for Windows Event logging at various levels of granularity

Linux auditd Detection Ruleset

Linux auditd ruleset that produces telemetry required for threat detection use cases

MITRE describes various data sources and how they relate to the TTPs found in the MITRE ATT&CK framework

Data source objects added to MITRE ATT&CK as part of v10

Splunk's proprietary model used as a framework for normalizing security data

Elastic's proprietary model used as a framework for normalizing security data

Exabeam Common Information Model

Exabeam's proprietary model used as a framework for normalizing security data

An opensource security data source and event schema

Loghub

Opensource and freely available security data sources for research and testing

Elastalert | Yelp

ElastAlert is a simple framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch

Matano

Open source cloud-native security lake platform (SIEM alternative) for threat hunting, Python detections-as-code, and incident response on AWS 🦀

To help with multi-table queries, you can use the advanced hunting schema, which includes tables and columns with event information and details about devices, alerts, identities, and other entity types

MITRE's open-source tool that can be used to track detection coverage, visibility, and other efforts and their relationship to the ATT&CK framework

A newsletter dedicated to news and how-tos for Detection Engineering

A Twitter list of Detection Engineering thought leaders

Outlines a methodology measuring security data visibility and detection coverage against the MITRE ATT&CK framework

Awesome Kubernetes (K8s) Threat Detection

Another Awesome List dedicated to Kubernetes (K8s) threat detection

Detection and Response Pipeline

A list of tools for each component of a detection and response pipeline which includes real-world examples

A collection of resources for thriving off the land

A detection engineering-focused podcast featuring many thought leaders in the specialization

A cloud detection engineering-focused database, that lists threat actors known to have compromised cloud environments, the tools and techniques in their arsenal, and the technologies they prefer to target

Splunk ES Correlation Searches Best Practices | OpsTune

A highly detailed guide to producing high quality detection content in the Splunk Enterprise Security app