nterl0k Goto Github PK

arcsight-sysmon-flexconnector

Microfocus ArcSight FlexConnector for Microsoft Sysmon tool

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

attack_data

A repository of curated datasets from various attacks

attack_range

A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

cef-syslog-canary

A simple set of VBA scripts, AutoIT, and Powershell for Blue Team usage.

deepbluecli

hibp-parser

PowerShell based parser for HaveIBeenPwned.com JSON reports

kerb-canary

A powershell script to enumerate malformed Kerberos tickets(Gold/Silver/etc)

mitre_sn_tags

Import MITRE Tactics and Techniques as ServiceNow Security Tags

prisma-cloud-compute-splunk

Splunk app for ingesting Prisma Cloud Compute incidents and forensics

rba

security-cmpivots

Simple collection of threat hunting queries for SCCM CMPivot

security_content

Splunk Security Content

sigma

Generic Signature Format for SIEM Systems

sof-elk

Configuration files for the SOF-ELK VM, used in SANS FOR572

splunk_bonus_content

A collection of random Splunk content, mostly security or Enterprise Security focused

sysmon-modular

A repository of sysmon configuration modules