New blue team

• dsiem

  3 430 6.3 Go

  Security event correlation engine for ELK stack

  

• sysmon-modular

  15 2,478 6.8 PowerShell

  A repository of sysmon configuration modules

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• auditd

  9 1,359 5.9

  Best Practice Auditd Configuration

• auditd-attack

  1 771 10.0

  A Linux Auditd rule set mapped to MITRE's Attack Framework

• Shuffle

  4 1,250 9.6 Shell

  Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.

  

• TheHive

  24 3,166 0.0 Scala

  TheHive: a Scalable, Open Source and Free Security Incident Response Platform

  

• AtomicPurpleTeam

  1 269 10.0

  Atomic Purple Team Framework and Lifecycle

  

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• caldera

  16 5,160 9.2 Python

  Automated Adversary Emulation Platform

  

• RedEye

  7 2,531 10.0 TypeScript

  Discontinued RedEye is a visual analytic tool supporting Red & Blue Team operations

  

• velociraptor

  5 2,644 9.6 Go

  Digging Deeper....

  

• adversary_emulation_library

  8 1,533 9.5 C

  An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

  

This is a great callout! To help get started, check out the adversary emulation library, https://github.com/center-for-threat-informed-defense/adversary_emulation_library. There are also micro-emulation plans, described here: https://ctid.mitre-engenuity.org/our-work/micro-emulation-plans/.

Suggest a related project