Python Libraries for Threat Detection Engineers
- I am not a Developer
- Detection Engineer who likes to apply python to my daily hunting and detection development
- My collection of threat detections
- Detection Logic Library
- Mostly KQL at the moment
- Detection logic stored in yaml format
- Organized a bit differently than other detection repos
- Detections are callable via python functions for hunting in a Jupyter NoteBooks or scripts
- Detect-as-Code or Detect-as-Config compatible
- Functions to connect to azure & other msft cloud services
- function to index my detections into a csv