threat-detection

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

Security sensor for realtime threat detection and protection

:cloud: :zap: Granular, Actionable Adversary Emulation for the Cloud

Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.

A curated knowledge base to build, run and mature a SOC (including CSIRT).

ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.

Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.

Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.

Threat-hunting tool for Linux

Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.