bert-janp Goto Github PK

alfa

ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework

awesome-detection-rules

This is a collection of threat detection rules / rules engines that I have come across.

awesome-kql-sentinel

A curated list of blogs, videos, tutorials, queries and anything else valuable to help you learn and master KQL and Microsoft Sentinel

aws_dataset

A dataset with CloudTrail events from an attack simulation using Stratus.

azsentinelqueries

Repository with Sentinel Analytics Rules and Hunting Queries

azure-sentinel

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

domain-response

Domain Response is a tool that is designed to help you automate the investigation for a domain. This tool is specificly designed to automated phishing domain investigations. However it can be used for every domain to gather all domain information needed. This can help to classify if a domain is malicious.

falconfriday

Hunting queries and detections

hunting-queries-detection-rules

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

incident-response-powershell

PowerShell Digital Forensics & Incident Response Scripts.

invictus-training

Repository with supporting materials for Invictus Academy/Training

kql_queries

KQL queries for Incident Response

mddrguidance

Links and guidance related to the return on mitigation report in the Microsoft Digital Defense Report

mde-dfir-resources

A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.

open-source-threat-intel-feeds

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

openssl-2022

Operational information about the recently announced vulnerability in OpenSSL 3

presentations

secscripts

Security Scripts and Sources for daily usage.

sentinel-automation

Sentinel Logic Apps/Playbooks to automate enrichment, incident analysis and more.

sentinel-queries

Collection of KQL queries

sigma-aws

This repository contains the research and components of our research into using Sigma for AWS Incident Response.