Regeln für Sicherheitserkennung
For ein Regelsatz für Detection-as-Code, the strongest matches are neo23x0/sigma (Sigma provides a vendor-neutral rule language YAML-based and a), falcosecurity/falco (Falco is a CNCF-graduated runtime security engine with its) and elastic/detection-rules (Elastic/detection-rules is a detection-as-code framework that provides a YAML). crowdsecurity/crowdsec and sigmahq/sigma round out the shortlist. Each is ranked by relevance to your query, popularity and recent activity.
Open-Source-Repositories mit Erkennungslogik und Verhaltensmustern zur Identifizierung bösartiger Aktivitäten in der Infrastruktur.
Regeln für Sicherheitserkennung
Finde die besten Repos mit KI.Wir suchen mit KI nach den am besten passenden Repositories.
- neo23x0/sigma
Neo23x0/sigma
10,591Auf GitHub ansehenSigma is a generic SIEM signature format and log event pattern standard used to describe malicious activity. It provides a vendor-neutral system for defining security event patterns in YAML, ensuring that detection logic remains portable across different monitoring platforms. The project maintains a curated library of peer-reviewed detection rules that identify threats and compliance violations. This standardized approach allows for the exchange of threat hunting logic and the translation of generic signatures into specific queries for various security information and event management systems
Sigma provides a vendor-neutral rule language (YAML-based) and a curated library of detection rules for security threats, making it a perfect fit for a threat detection rule framework, though it focuses on rule portability and SIEM translation rather than built-in alerting.
PythonThreat Detection Rule RepositoriesThreat Detection Rule Repositories - falcosecurity/falco
falcosecurity/falco
8,670Auf GitHub ansehenFalco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments
Falco is a CNCF-graduated runtime security engine with its own rule language (Falco rules), a community-maintained rules library, kernel event capture, alerting, and SIEM integration, making it a comprehensive threat detection rule framework that directly meets this search.
C++SIEM IntegrationThreat Detection Rule Repositories - elastic/detection-rules
elastic/detection-rules
2,508Auf GitHub ansehenThis project is a detection-as-code framework providing a library of security monitoring rules and predefined detection content for Elasticsearch data indices. It serves as a threat detection rule library designed to identify malicious activity and attack patterns across diverse data streams in cloud and on-premises environments. The framework implements a detection engineering workflow where rules are defined in YAML and managed as versioned code. It includes a set of command-line utilities for automated rule deployment, metadata searching, and template generation, supported by a Python-base
Elastic/detection-rules is a detection-as-code framework that provides a YAML rule language, a library of threat detection rules for Elasticsearch data, and CLI tools for managing and deploying rules — directly giving you the rule-writing toolkit and rule content you need, though its integration is specific to the Elastic stack rather than a multi-SIEM solution like Sigma.
PythonThreat Detection Rule Repositories - crowdsecurity/crowdsec
crowdsecurity/crowdsec
12,574Auf GitHub ansehenCrowdSec is a collaborative, distributed security engine designed for threat detection and infrastructure protection. It functions as an intrusion detection system that parses logs and network traffic to identify malicious patterns, utilizing a bucket-based threshold detection model to aggregate events and trigger alerts. The platform is built on a modular architecture that includes a centralized local API server for managing security signals and a relational database for persistent storage of remediation decisions. What distinguishes the project is its decoupled enforcement model, which offl
CrowdSec is a full-featured open-source threat detection engine that provides its own YAML-based rule language (scenarios), a community rule hub, log acquisition parsers, built-in rule testing, and alerting integrations, making it a comprehensive framework for writing and running detection rules against security logs.
GoIntrusion Prevention SystemsSecuritySecurity Event Correlation - sigmahq/sigma
SigmaHQ/sigma
10,136Auf GitHub ansehenSigma is a suite of tools for defining generic log signatures and translating them for multiple backends. It provides a structured way to define malicious behavior and detection logic independently of any specific backend technology, acting as a translation engine that maps generic event fields and correlation logic to the proprietary query languages of security data lakes and SIEM platforms. The project features a plugin-based multi-backend query generator that exports security detections into various database and log management formats. It also includes a threat framework mapping tool that
Sigma provides the Sigma rule language itself plus a full toolchain for writing, testing, and translating detection rules into a wide range of SIEM and data pipeline queries, exactly matching the need for an open-source threat detection rule framework with community rules and multi-backend integration.
PythonQuery Translation LayersSIEMDetection Engineering
