kestrel-lang
Kestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.
AI summary
Threat hunt workflow builder
A language and runtime framework for building reusable, composable threat hunting workflows using Python.
- stars
- 302
- forks
- 51
- watching
- 16
Similar projects
Found by comparing what the projects do, not just their names.
Threat detection framework
A modular threat-hunting tool framework for detecting indicators of compromise in incident-response operations.
Threat Hunting Platform
A collection of tools and resources for threat hunters to identify and respond to cyber threats.
Threat intel manager
A tool for gathering and managing threat intelligence data from various feeds.
Threat hunter
A platform for searching and analyzing publicly available online data to detect potential security threats
Threat Hunter
A community-driven project providing shared detection logic and resources for threat hunting
Threat hunter
Automates scanning of publicly hosted pasted data against Yara rules to identify potential security or research threats.
Threat Hunter
Automated platform for discovering and analyzing cybersecurity threats targeting an organization
Threat simulator
A PowerShell repository to simulate and train threat hunting skills without malicious files.
Threat detection resource
An informational repository providing resources and knowledge for detecting adversaries in IT environments.
Event monitor
An eBPF-based tool for comprehensive Linux event monitoring and analysis
Threat Aggregator
Automates aggregation of security threat data from various online sources
Threat Scanner
Extracts and aggregates threat intelligence from various sources
IoT threat hunter
A tool for hunting and tracking Internet of Things (IoT) security threats by collecting and analyzing indicators of compromise (IOCs)
Domain scanner
Tools and rules for detecting malicious domain calls in endpoint malware
Threat collector
A framework to collect and visualize threat intelligence information from various sources in a flexible and plugin-based architecture.
