awesome-detection-engineering

An open MIT detection-rule standard for AI-agent and MCP attacks (prompt injection, tool poisoning, context exfiltration), like Sigma or YARA for the agent layer, with OWASP LLM/Agentic and MITRE ATLAS mappings on each rule.

Anvilogic's opensource and publicly available detection content.

Mapping of open-source detection rules and atomic tests.

A list of all AWS GuardDuty Findings, their descriptions, and associated data sources.

A list of all Azure Security for Cloud Alerts, their descriptions, and associated data sources.

A matrix of MITRE ATT&CK technique IDs and links to available Splunk Security Content, Elastic detection rules, Sigma rules, and CAR content.

A blueprint for creating and documenting effective detection content.

Blue-Team-as-Code: Lessons From Real-world Red Team Detection Automation Using Logs.

Lockheed Martin's framework that outlines the 7 stages commonly observed in a cyber attack.

Snowflake’s implementation of the Detection Development Lifecycle.

A community framework with four maturity levels across ten dimensions for assessing how organizations apply AI and LLMs across a detection engineering program, from foundations through the detection lifecycle.

a series of posts exploring the various foundational components of Detection Engineering.

MITRE's open-source tool that can be used to track detection coverage, visibility, and other efforts and their relationship to the ATT&CK framework.

Another Awesome List dedicated to Kubernetes (K8s) threat detection.

A cloud detection engineering-focused database, that lists threat actors known to have compromised cloud environments, the tools and techniques in their arsenal, and the technologies they prefer to target.

Practical CTI-to-detection reference covering evidence labels, source reliability, ATT&CK mapping gates, hunting hypotheses, and detection backlog workflow.

A list of tools for each component of a detection and response pipeline which includes real-world examples.

A detection engineering-focused podcast featuring many thought leaders in the specialization.

ElastAlert is a simple framework for alerting on anomalies, spikes, or other patterns of interest from data in Elasticsearch.

Elastic's proprietary model used as a framework for normalizing security data.

Exabeam's proprietary model used as a framework for normalizing security data.

Autonomous security agent for Linux with real-time threat detection and response via 38 eBPF hooks, 48 detectors, and 23 correlation rules.

Linux auditd ruleset that produces telemetry required for threat detection use cases.

Opensource and freely available security data sources for research and testing.