Popular repositories

1. Microsoft-eventlog-mindmap Microsoft-eventlog-mindmap Public

   Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...

   983 180

2. EVTX-to-MITRE-Attack EVTX-to-MITRE-Attack Public

   Set of EVTX samples (>270) mapped to MITRE ATT&CK tactic and techniques to measure your SIEM coverage or developed new use cases.

   476 81

3. SIGMA-detection-rules SIGMA-detection-rules Public

   Set of SIGMA rules (>320) mapped to MITRE ATT&CK tactic and techniques

   269 54

4. Splunk-input-windows-baseline Splunk-input-windows-baseline Public

   Provides an advanced input.conf file for Windows and 3rd party related software with more than 70 different event log mapped to the MITRE Att&CK

   72 10

5. Windows-auditing-baseline Windows-auditing-baseline Public

   Provides an advanced baseline to implement a secure Windows auditing strategy on Windows OS.

   25 4

6. Windows-WEC-server_auto-deploy Windows-WEC-server_auto-deploy Public

   PowerShell scripts for fast Windows Event Collector configuration with Palantir toolset

   Roff 20 8