Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
This page lists names, links and short descriptions. The original list on GitHub is the source and belongs to its authors.
The foundational framework of adversary tactics, techniques, and procedures based on real-world observations.
A blueprint for creating and documenting effective detection content.
A detailed matrix that serves as a tool to measure the overall maturity of an organization's Detection Engineering program.
Defines and describes 8 different levels of an organization's threat detection program maturity.
A model used to describe various categorizations of indicator's of compromise and their level of effectiveness in detecting threat actors.
Lockheed Martin's framework that outlines the 7 stages commonly observed in a cyber attack.
A business-centric approach for defining threat detection use cases.
Synthetic Adversarial Log Objects (SALO) is a framework for the generation of log events without the need for infrastructure or actions to initiate the event that causes a log event.
Outlines 19 aphorisms that serve as universal principles for the creation of high quality detection content.
Blue-Team-as-Code: Lessons From Real-world Red Team Detection Automation Using Logs.
Snowflake’s implementation of the Detection Development Lifecycle.
A maturity matrix to measure the success of your threat detection program.
Elastic's qualitative and quantitative approach to measuring threat detection program maturity.
A community framework with four maturity levels across ten dimensions for assessing how organizations apply AI and LLMs across a detection engineering program, from foundations through the detection lifecycle.
A longtime detection engineer outlines how a detection engineering program should be built from the ground up.
a series of posts exploring the various foundational components of Detection Engineering.
an all-in-one Detection Engineering Operations framework created and maintained by the European Commission to convert your CTI into an actionable detection coverage graph combining threat vectors with detection objectives, and manage your entire detection library from a central repository with a…
CTI-to-detection workbench for mapping threat reports to ATT&CK, comparing TTP overlap with groups and campaigns, identifying detection gaps, and exporting analyst-ready outputs.
Agentic memory system that treats Sigma and YARA rules as first-class memory entities, with an LLM rule explainer, STIX 2.1 knowledge graph of CTI entities, and offline-first RAG to connect rules to the actors and techniques they detect. Python, MIT.
An index of publicly available and open-source threat detection rulesets.
MITRE's well-maintained repository of detection content.
A matrix of MITRE ATT&CK technique IDs and links to available Splunk Security Content, Elastic detection rules, Sigma rules, and CAR content.
Sigma's repository of turnkey detection content. Content can be converted for use with most SIEMs.
An opensource tool that can convert detection content for use with most SIEMs.
A complete Sigma detection engineering toolkit with parser, evaluation engine, rule conversion, streaming runtime, linter, CLI, MCP, and LSP.
Mapping of open-source detection rules and atomic tests.
Splunk's open-source and frequently updated detection content that can be tweaked for use in other tools.
Elastic's detection rules written natively for the Elastic SIEM. Can easily be converted for use by other SIEMs using Uncoder.
Elastic's endpoint behavioral (prevention) rules written in EQL, natively for the Elastic endpoint agent.
An open MIT detection-rule standard for AI-agent and MCP attacks (prompt injection, tool poisoning, context exfiltration), like Sigma or YARA for the agent layer, with OWASP LLM/Agentic and MITRE ATLAS mappings on each rule.
Chronicle's detection rules written natively for the the Chronicle Platform.
Exabeam's out of the box detection content compatible with the Exabeam Common Information Model.
Panther Lab's native detection rules.
Anvilogic's opensource and publicly available detection content.
A list of all AWS GuardDuty Findings, their descriptions, and associated data sources.
A list of all GCP Security Command Center Findings, their descriptions, and associated data sources.
A list of all Azure Security for Cloud Alerts, their descriptions, and associated data sources.
Describes cloud computing platform's (Azure, AWS) built-in detection capabilities and their mapings to the MITRE ATT&CK framework.
A GitHub repo dedicated to sharing detection analytics in SPL.
This repository serves as a community-driven list of sample security analytics for auditing cloud usage and for detecting threats to your data & workloads in Google Cloud.
A list of endpoint detections and hunting queries for Microsoft Defender for Endpoint, Defender For Identity, and Defender For Cloud Apps.
A repository of all SIGMA rules converted to KQL that runs on a weekly schedule to update the repository and align with the up to date version of the SIGMA rules repository.
A repository of all SIGMA rules converted to Microsoft Sentinel Terraform Scheduled analytic resources. The repository runs on a weekly schedule to update the repository and align with the up to date version of the SIGMA rules repository. Proper entity mapping is completed for the rules to ensure…
A newsletter that features updates from many popular detection content sources listed here.
Multiple cheatsheets outlined recommendations for Windows Event logging at various levels of granularity.
Linux auditd ruleset that produces telemetry required for threat detection use cases.
MITRE describes various data sources and how they relate to the TTPs found in the MITRE ATT&CK framework.
Data source objects added to MITRE ATT&CK as part of v10.
Splunk's proprietary model used as a framework for normalizing security data.
Elastic's proprietary model used as a framework for normalizing security data.
Exabeam's proprietary model used as a framework for normalizing security data.
An opensource security data source and event schema.
A SQL-powered operating system instrumentation, monitoring, and analytics framework that exposes OS data as relational tables for querying and detection.
Opensource and freely available security data sources for research and testing.
ElastAlert is a simple framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch.
Open source cloud-native security lake platform (SIEM alternative) for threat hunting, Python detections-as-code, and incident response on AWS 🦀.
To help with multi-table queries, you can use the advanced hunting schema, which includes tables and columns with event information and details about devices, alerts, identities, and other entity types.
Autonomous security agent for Linux with real-time threat detection and response via 38 eBPF hooks, 48 detectors, and 23 correlation rules.
Open-source endpoint detection engine for Windows and Linux that collects ETW/eBPF telemetry and evaluates Sigma, YARA, and IOC detections.
Open source, LLM driven SOC automation platform for MSPs and MSSPs built on Wazuh. Triages, investigates, and escalates alerts through a two tier AI pipeline with human in the loop review, multi tenant isolation, and a no code triage policy editor backed by deterministic execution. Apache 2.0.
MITRE's open-source tool that can be used to track detection coverage, visibility, and other efforts and their relationship to the ATT&CK framework.
A newsletter dedicated to news and how-tos for Detection Engineering.
A Twitter list of Detection Engineering thought leaders.
Outlines a methodology measuring security data visibility and detection coverage against the MITRE ATT&CK framework.
Another Awesome List dedicated to Kubernetes (K8s) threat detection.
A list of tools for each component of a detection and response pipeline which includes real-world examples.
A collection of resources for thriving off the land.
A detection engineering-focused podcast featuring many thought leaders in the specialization.
A cloud detection engineering-focused database, that lists threat actors known to have compromised cloud environments, the tools and techniques in their arsenal, and the technologies they prefer to target.
Practical CTI-to-detection reference covering evidence labels, source reliability, ATT&CK mapping gates, hunting hypotheses, and detection backlog workflow.
A highly detailed guide to producing high quality detection content in the Splunk Enterprise Security app.
The team at Google highlights 5 key principles for building a high quality, scalable and modern threat detection program.
A lab for blue teamers and detection engineers, with real threat data and support for popular SIEM query languages, enabling hands-on learning and practice in detection rule writing and threat hunting.
awesome-selfhosted/awesome-selfhosted
A list of Free Software network services and web applications which can be hosted on your own servers
lissy93/awesome-privacy
🦄 A curated list of privacy & security-focused software and services
vavkamil/awesome-bugbounty-tools
A curated list of various bug bounty tools
ashishb/android-security-awesome
A collection of android security related resources
edoardottt/awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
qazbnm456/awesome-web-security
🐶 A curated list of Web Security materials and resources.