How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
Sigma is a suite of tools for defining generic log signatures and translating them for multiple backends. It provides a structured way to define malicious behavior and detection logic independently of any specific backend technology, acting as a translation engine that maps generic event fields and correlation logic to the proprietary query languages of security data lakes and SIEM platforms. The project features a plugin-based multi-backend query generator that exports security detections into various database and log management formats. It also includes a threat framework mapping tool that
Sigma is a generic SIEM signature format and log event pattern standard used to describe malicious activity. It provides a vendor-neutral system for defining security event patterns in YAML, ensuring that detection logic remains portable across different monitoring platforms. The project maintains a curated library of peer-reviewed detection rules that identify threats and compliance violations. This standardized approach allows for the exchange of threat hunting logic and the translation of generic signatures into specific queries for various security information and event management systems
This repository contains a list of which tools each ransomware gang or extortionist gang uses - As defenders, we should exploit the fact that many of the tools used by these cybercriminals are often reused - We can threat hunt, deploy detections, and block these tools to eliminate the ability of…
A tool matrix for Russian APTs based on the Ransomware Tool Matrix
This project aims to compare and evaluate the telemetry of various EDR products.
The main features of tsale/edr-telemetry are: Detection Engineering.
Projects with overlapping indexed features include: sigmahq/sigma — Sigma is a suite of tools for defining generic log signatures and translating them for multiple backends. It provides… neo23x0/sigma — Sigma is a generic SIEM signature format and log event pattern standard used to describe malicious activity. It… bushidouk/ransomware-tool-matrix — This repository contains a list of which tools each ransomware gang or extortionist gang uses - As defenders, we… certcc/ssvc — The Stakeholder-specific Vulnerability Categorization (SSVC) is a system for prioritizing actions during vulnerability… cyb3rxp/awesome-soc. bushidouk/russian-apt-tool-matrix — A tool matrix for Russian APTs based on the Ransomware Tool Matrix.