Corelight-Ansible-Roles

Corelight-Ansible-Roles Caution: Before you run this version, if you are upgrading, some variable names and locations have changed To get started, simply run this command: source curl https://raw.githubusercontent.com/corelight/Corelight-Ansible-Roles/main/download-run-me-first.sh This product...

SynthAPT

SynthAPT Resumen SynthAPT es un marco de simulación de adversarios basado en playbooks para replicar rutas de ataque complejas. Está diseñado para validar detecciones avanzadas y agentes de investigación basados en IA. La idea central es que el comportamiento del malware puede expresarse en JSON ...

phantom-playbooks

This is the Corelight Repository for Community Playbooks developed for Splunk Phantom. These provide some examples for you to craft your own playbooks. Corelight Investigate DNS Alert This playbook takes a saved search or alert mechanism for DNS from Splunk and pulls the Zeek UID for the alerts. ...

SCOPE

SCOPE: Security Cloud Ops Purple Engagement SCOPE runs AWS purple-team workflows with deterministic Python inventory and bounded AI agents. It audits AWS resources, validates attack paths, generates review-only exploit playbooks, produces controls, and guides Splunk investigations. How It Works R...

How-To-Secure-A-Linux-Server

Cómo asegurar un servidor Linux Una guía en evolución para asegurar un servidor Linux que, con suerte, también te enseña un poco sobre seguridad y por qué es importante. Tabla de Contenidos Introducción Objetivo de la Guía Por Qué Asegurar Tu Servidor Por Qué Otra Guía Más Otras Guías Por Hacer /...

Azure-Sentinel

Microsoft Sentinel y Microsoft 365 Defender Bienvenido al repositorio unificado de Microsoft Sentinel y Microsoft 365 Defender. Este repositorio contiene detecciones listas para usar, consultas de exploración, consultas de búsqueda, libros, runbooks y mucho más para ayudarte a ponerte al día con...

threatbox

Threatbox - Plataforma de Ataque Estándar ThreatBox es una plataforma de ataque estándar y controlada basada en Linux. He utilizado una versión de esto durante años. Comenzó como una colección de scripts, existió como una máquina virtual continua, se convirtió en código para construir una ISO de...

prowler

Prowler Prowler is a Network Vulnerability Scanner implemented on a Raspberry Pi Cluster, first developed during Singapore Infosec Community Hackathon - HackSmith v1.0. Capabilities Scan a network a particular subnet or a list of IP addresses for all IP addresses associated with active network...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

SOARCA

Automatizar los flujos de trabajo de respuesta a amenazas e incidentes con playbooks de seguridad CACAO Contexto y antecedentes Las organizaciones automatizan cada vez más la respuesta a amenazas e incidentes mediante la orquestación de flujos de trabajo de seguridad impulsados por playbooks. La...

ghostbusters15

ghostbusters15 Playbooks 'Solución para CVE-2015-0235GHOST' ejecutándose en Ansible...

Playbooks

Table of Content TOC IR Playbooks This repository contains all the Incident Response Playbooks and Workflows of Company's SOC. Each folder contains a Playbook that is broken down into 6 section as per NIST - 800.61 r2 1- Preparation This section should include the following informations List of A...

CVE-2026-9812

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...

CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...

CVE-2026-9812

Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 contain a missing validation flaw in the Playbooks plugin's run property update endpoint. The endpoint does not verify that a referenced property field belongs to the specified run before updating its va...

EUVD-2026-77374

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...

awesome-soc — Updated!

Awesome SOC An operational handbook and knowledge base to build, run and mature a SOC including CSIRT. Covering: SOC basics detection engineering threat intelligence SOC metrics/KPI SOC automation AI use cases and best practices SOP SOC playbooks Those are my view, based on my own experience as...

CVE-2026-76368

CVE-2026-76368 is a missing authorization flaw in Splunk SOAR versions below 8.6.0 . The Playbook History feature does not check repository permissions before returning playbook revision metadata, allowing a user who holds the playbooks:view permission to view metadata about playbook repositories...

Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots

A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make the bots send...

PYSEC-2026-1123 Ansible-Core vulnerable to content protections bypass

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playboo...