CVE-2024-28784

CVE-2024-28784 — Stored XSS in IBM QRadar SIEM Rule Wizard 🛠 Product Information Vendor: IBM Product: IBM Security QRadar SIEM Affected Version: 7.5.0 UpdatePackage 7 Build 20230822112654 Component: Rule Wizard Regular Expression Logic Block CVE ID: CVE-2024-28784 🐞 Vulnerability Summary A stored...

sigma

Sigma - Generic Signature Format for SIEM Systems Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims...

macnoise

MacNoise MacNoise generates real macOS telemetry: network connections, file writes, process spawns, plist mutations, TCC probes, and more. Point it at a machine running your EDR, SIEM, or firewall stack and see what actually fires - not what the vendor datasheet claims will fire. For background o...

deadair

deadair comprueba si las detecciones de SIEM habilitadas todavía disponen de la telemetría que necesitan. Informa de datos ausentes o desactualizados, retrasos de ingesta e inconsistencias de esquema. Se ejecuta localmente · Solo lectura · Sin agente · Sin envío de telemetría Lee el análisis...

CyberDefense-Lab

Cyber Security Lab: Blue Team Infrastructure & Network Defense This laboratory project demonstrates the creation of an integrated "Blue Team" infrastructure, focusing on centralized network security, Intrusion Detection/Prevention Systems IDS/IPS, and Security Information and Event Management SIE...

RedELK

RedELK The Red Team's SIEM - a tool for Red Teams for tracking and alarming about Blue Team activities as well as enhanced usability in long term operations. 1. Enhanced usability and overview for the red team operators by creating a central location where all relevant operational logs from...

Incident-Response-Powershell

Powershell Digital Forensics & Incident Response This repository provides PowerShell-based Incident Response scripts. DFIR Script The DFIR-Script.ps1 script collects forensic artifacts on Windows devices. Key features include: Collecting over 25 potential indicators of compromise. CSV-based expor...

FalconHound

FalconHound NOTE: As of the BloodHound CE 7.0 release, the default database has been switched to Postgres. This version of FalconHound still relies on Neo4j to be the default database. If you want to keep using FalconHound while running the latest BloodHound version, add the following line to you...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

intel471-threat-hunting-cve-2023-46604

Intel 471 Threat Hunting Workshop – CVE-2023-46604 Investigation Overview This repository documents my first hands-on experience with Intel 471’s Intelligence-Driven Threat Hunting Workshop focused on CVE-2023-46604. Through this practical workshop, I investigated how attackers leveraged a critic...

SentinelStream-AI

SentinelStream AI | Next-Gen SIEM & SOAR Platform Project Overview SentinelStream AI is a high-velocity Security Information and Event Management SIEM platform designed to bridge the gap between asset vulnerability and real-time threat intelligence. Built as a "Workshop-Ready" product, it allows...

ossec-hids

Información sobre OSSEC OSSEC es una plataforma completa para monitorear y controlar tus sistemas. Combina todos los aspectos de HIDS detección de intrusiones basada en host, monitoreo de registros y SIM/SIEM en una solución simple, potente y de código abierto. Visita nuestro sitio web para obten...

ossec-hids

OSSEC v4.3.0 Information about OSSEC OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. Visit our website for the latest...

laurel

Linux Audit – Usable, Robust, Easy Logging LAUREL is an event post-processing plugin for auditd8 that generates useful, enriched JSON-based audit logs suitable for modern security monitoring setups. Documentation corresponding to the latest stable release can be found here. Why? TLDR: Instead of...

rustinel

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Bring your detection content, monitor your endpoints, and send alerts to the...

S1EM

Objetivos Hoy en día, los ciberataques son más numerosos y causan daños en las empresas. No obstante, existen muchos productos de software para detectar amenazas cibernéticas. La solución S1EM se basa en el principio de reunir los mejores productos en su campo, de forma gratuita, y hacerlos...

Query-Hub

CQL-Hub | CrowdStrike SIEM & LogScale Queries Welcome to the CQL-Hub Backend Repository This repository powers cql-hub.com: A free, community-driven hub for CrowdStrike Falcon SIEM queries. All queries stored here are automatically published and made visible on the CQL-Hub website, making it easi...

soc-automation-lab

SOC Automation Lab This repository documents the design, detection logic, automation workflows, and lessons learned from building an automated SOC demo using open-source tools. The project focuses on how alerts move from detection to investigation and notification , and what breaks along the way...

agentic-threat-hunting-framework

Agentic Threat Hunting Framework ATHF Quick Start • Installation • Documentation • Examples Give your threat hunting program memory and agency. The Agentic Threat Hunting Framework ATHF is the memory and automation layer for your threat hunting program. It gives your hunts structure, persistence,...

content-packs

Content Packs for Eventum Ready-to-use generator projects for Eventum that produce realistic synthetic events mimicking real SIEM data sources. Each generator outputs ECS-compatible JSON that can be ingested directly into Elasticsearch, OpenSearch, or any SIEM platform. Quick Start With Docker...