awesome-detection-engineer
github.com/st0pp3r/awesome-detection-engineer ↗Online resources related to Detection Engineering. Detection rules, detection logic, attack samples, detection tests and emulation tools, logging configuration and best practices, event log references, resources, labs, data manipulation online tools, blogs, newsletters, good reads, books, trainings, podcasts, videos and twitter/x accounts.
Use this list with your AI agent
Add the Context Awesome MCP server to Claude, Cursor, or any MCP client, then ask:
"Show me event log references resources from awesome-detection-engineer"
Installation instructions →What's inside
Event Log References
Good Reads
Detection Tests and Emulation Tools
- Active Directory Attack Tests | Picus
Handbook with active directory attack tests.
- APT Simulator
Windows batch script that uses a set of tools and output files to make a system look as if it was compromised.
- Atomic Red Team | Red Canary
Tests mapped to the MITRE ATT&CK framework.
- Eventum
Data generation platform for producing synthetic event streams with complex correlations.
- Game of Active Directory Lab | Orange CyberDefense
- HackingTheCloud
Encyclopedia of the attacks/tactics/techniques for cloud exploitation.
Detection Logic
- Active Directory Security (adsecurity.org)
Page dedicated to Active Directory security. Includes attack descriptions and detection recommendations.
- Antivirus Cheatsheet | Nextron Systems
Antivirus keywords and detection logic from Nextron.
- Awesome Lists | mthcht
Includes keywords, paths from various tools that can be used to implement detection logic.
- Detecting the Elusive Active Directory Threat Hunting
Bsides presentation that includes detection logic for active directory attacks.
- Offensive Kerberos Techniques for Detection Engineering | Noah
Resources
- AD Detection Engineering Notes
- Adversarial Detection Engineering Framework
Adversarial Detection Engineering (ADE) is the discipline of reasoning about False Negatives in detection rules.
- Alerting and Detection Strategies (ADS) Framework | Palantir
- Detection Engineering Cheatsheet | Florian Roth
Cheatsheet for prioritizing detection development.
- Detection Engineering Maturity (DML) Model | Ryan Stillions
A tool for assessing an organization’s detection engineering capabilities and maturity levels.
- Detection Engineering Maturity Matrix | Kyle Bailey
Aims to help the community better measure the capabilities and maturity of their detection function.
Blogs
- Alex Teixeira on Medium
Frequently writes about detection engineering topics.
- Detect.fyi
Collection of good detection engineering articles.
- Detection at Scale
Collection of good detection engineering articles.
- Detections.xyz
Collection of good detection engineering articles.
- Elastic Security Labs Blog
- FalconForce Blog
Detection Rules
- Anvilogic Detection Armory
Public versions of the detections from the Anvilogic Platform Armory.
- Attack Rule Map
Mapping of open-source detection rules.
- Chronicle (GCP) Rules
- Clankerusecase
Open-source library of 7,800+ MITRE ATT&CK-mapped detections in Defender KQL, Sentinel KQL, Sigma, Splunk SPL, Datadog, Falcon & CloudWatch, generated from live threat-intel and schema-validated.
- Datadog Detections
Collection of detection rules by Datadog.
- DetectionCode
Detection rules search engine.
Showing a sample of 237 resources. View the full list on GitHub →