Awesome Security lists for SOC/CERT/CTI

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

Tenzir is the data pipeline engine for security teams.

SIEM Logstash parsing for more than hundred technologies

Splunk Labs

In this repository you may find KQL (Kusto Query Language) queries and Watchlist schemes for data sources related to Microsoft Sentinel (a SIEM tool).

Free and open log management

SEKOIA.IO Documentation - The Intelligence-Driven SaaS SIEM

pySigma backend for generating Grafana Loki/LogQL rules

Unified Log Streamer (ULS)

Go Package for ArcSight's Common Event Format (CEF)

Main Sigma Rule Repository

Welcome to the Cloud Security Toolkit repository, your all-in-one destination for cutting-edge cloud security resources! Whether you're diving into offensive strategies, mastering threat hunting, or bolstering your blue-team defenses, this repo has you covered.

A collection of various cybersecurity notes written in Markdown

A packaging tool for Splunk apps. Package up your Splunk app configuration files, get them validated and push them to splunkcloud with a cli tool or github actions

Automate home server with Ansible

I set up Windows virtual machine using a cloud based platform such as Microsoft Azure Sentinel (SIEM) as a Honeypot. I was able to then analyze live cyber attacks. I used a Powershell script to look up the attackers geolocation info and plot it on the Azure Sentinel map!

I applied the necessary codes and configurations to complete the installation of my T-POT using my virtual machine such as Debian Linux on the VirtualBox and a cloud based platform such as Microsoft Azure to create the ultimate multi-Honeypot platform to analyze cyber attacks. It was a great personal achievement!

An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.

This repository contains automation scripts and configurations for Security Operations Centers (SOC). It includes tools for incident response, log management, and security alerting, aimed at streamlining SOC workflows and enhancing security event monitoring and management.