KQL-threat-hunting-queries

KQLクエリを使用した脅威ハンティング/検出 | |/ / | | | | | | | | | / | | | | | | | | | \ | | | | \ | |/ | | ' | | | | | | | | || | | | | / \ | | | || | | | | | | | | | || | | | | . | || | | | | | | !NOTE 1月27日: 約1年間のコントリビューションを経て、このリポジトリは現在のコミュニティの状況に対応し、さらに貢献を続けるためのより良い文脈化を実現するため、大規模な再構築を行っています。...

Gideon

██████╗ ██╗██████╗ ███████╗ ██████╗ ███╗ ██╗ ██╔════╝ ██║██╔══██╗██╔════╝██╔═══██╗████╗ ██║ ██║ ███╗██║██║ ██║█████╗ ██║ ██║██╔██╗ ██║ ██║ ██║██║██║ ██║██╔══╝ ██║ ██║██║╚██╗██║ ╚██████╔╝██║██████╔╝███████╗╚██████╔╝██║ ╚████║ ╚═════╝ ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═══╝ 자율 사이버보안 운영 및 레드 팀 에이전트...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

PatrowlManager

Codacy Badge PatrOwl PatrOwl은 확장 가능하고 무료인 오픈 소스 보안 운영 오케스트레이션 솔루션입니다. PatrowlManager 는 자산 관리, 실시간 위험 검토, 운영 오케스트레이션스캔, 검색, API 호출 등, 결과 집계, 타사예: TheHive, Splunk 등과 같은 인시던트 대응 플랫폼에 알림 전달, 보고서 및 대시보드 제공을 위한 프론트엔드 애플리케이션입니다. 운영은 PatrowlEngines 인스턴스에 의해 수행됩니다. 설치와 배포를 잊지 마세요 ; 프로젝트 피치 데스크 지금 사용해보세요!...

Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security

LLM-based multi-agent systems MAS engage tools, share memory, and delegate tasks, often encountering adversarial content. Current defenses for MAS are typically evaluated in isolation, focusing on one attack type at a time, which can lead to costly and hard-to-audit outcomes. This study organizes...

security-operations-labs

Security Operations Labs 概要 このリポジトリは、大学の文脈における防御的セキュリティ業務を、公開での追跡可能性のために再構成した形でまとめたものです。焦点は、方法論、再現可能なラボ、検証、および開発された対策の限界にあり、コース教材の公開ではありません。 含まれるプロジェクト プロジェクト| 内容 ---|--- Threat Modeling| STRIDE分析、MITRE-ATT&CKマッピング、抽象化されたDFD、リスクレジスタ IT/OTネットワークセグメンテーション| iptablesによるデフォルト拒否ゲートウェイ、ロギング、管理された検証 Snor...

The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations

Featuring: Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibilit...

Investing Together: Wiz Defend and Google Security Operations

Continuing to deepen the integration between Wiz Defend and Google Security Operations, helping teams work faster wherever they choose to investigate...

When the Whole Company Adopts AI: What It Does to Your SOC

Over the past year, we watched a new class of alert appear in enterprise security operations centers and grow faster than anything else in the stream: alerts that were triggered by AI tools and agents. Not attacks against AI, but the ordinary, everyday footprint of an organization using it, from...

Webinar: Learn How to Answer “Are We Exposed?” Faster After a New CVE

A major vulnerability is disclosed. The alert lands immediately. Then comes the harder question: Are we actually exposed? For many security teams, answering that means jumping between vulnerability scanners, endpoint tools, cloud inventories, SBOMs, repositories, and application data to build...

Can Risk-Based Alerting Mitigate Cybersecurity Alert Fatigue?

Security operations centers SOCs face large numbers of false alerts, making detection of cyberattacks difficult under typical resource constraints. Risk-based alerting RBA has been proposed as a means to reduce false alerts and has reportedly succeeded in doing so in various enterprise deployment...

Learn How to Build Security Operations Ready for AI-Powered Attacks

Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster than traditional security...

What the Data Says About AI in Security Operations in 2026

AI is officially mainstream in security operations. According to Prophet Security's State of AI in Security Operations 2026 report produced from ViB’s survey of 250+ cybersecurity pros, 40% of security teams now use AI daily. Another 56% are currently testing it out, and only 4% have no plans to...

Imagine the SOC Without a Queue: From Alert Backlog to AI Hypothesis Engine

The SOC we've always known was built around a model that guarantees most of the alert queue will never receive analyst review. There's never time. In a traditional SOC, the typical progression follows a well-known pattern: an alert arrives; a detection engine assigns a severity score. The issue...

PatrowlManager v1.8.4

Codacy Badge PatrOwl PatrOwl is a scalable, free and open-source solution for orchestrating Security Operations. PatrowlManager is the Front-end application for managing the assets, reviewing risks on real-time, orchestrating the operations scans, searches, API calls, ..., aggregating the results...

Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise

Security teams are being asked to defend a growing attack surface with fewer people and around the clock, against threat actors who never take a night off. As cyberattackers increasingly use AI to launch and scale campaigns, the volume, speed, and sophistication of threats continue to rise. Closi...

CyberStrikeAI v1.7.12

CyberStrikeAI 中文 | English The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next. CyberStrikeAI connects planning, execution, human oversight, evidence, and replay in one auditable...

CVE-2026-15587

CVE-2026-15587 affects Google SecOps (Chronicle SOAR) prior to version 6.3.85 on Google Cloud Platform. An authenticated attacker could escalate to system-level admin via a crafted internal authentication header. The issue is mitigated by upgrading to 6.3.85; Google notes no customer action is re...

Kali365 Exploits Microsoft Device Login to Access US Corporate Data

Learn how Kali365 has been abusing Microsoft device login to gain OAuth tokens, targeting US firms, and how SOC teams can detect, hunt, and stop these phishing attacks...

Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps

The calculus of cybersecurity has changed. AI is reshaping how organizations build, deploy, operate, and defend digital systems. AI-powered development tools, agents, and autonomous workflows are accelerating innovation but they are also introducing new attack surfaces, new trust boundaries, and...