The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning. Learn more →
Security_content Alternatives
Similar projects and alternatives to security_content
-
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
-
WorkOS
The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
-
awesome-cybersecurity-blueteam
:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
security_content reviews and mentions
-
SIEM content development
There's a ton of valuable resources out there when searching for "detection engineering", beyond that, check https://research.splunk.com/ to get an idea of a structured and contextual approach. Beyond that, check Rob van Os Magma use case framework and any blog you can find on https://correlatedsecurity.com (Jurgen Visser). Last but not least, anything "awesome" on github, e.g. https://github.com/fabacab/awesome-cybersecurity-blueteam
-
Azure data sources
Some additional reading: - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2020/07/Azure-Sentinel-whitepaper.pdf - here it from the vendor; solid read as correct log sourcing/scoping is SIEM-vendor agnostic; also check the Sentinel KQL github for inspiration - https://research.splunk.com/ - your new browser startpage - check for Azure/MS/M365 rekated content
-
Okta Data in Splunk( Reports, Alerts and Dashboards)
Indeed, as well as the Okta analytic stories/detections at research.splunk.com. In fact, three new ones published yesterday where Okta and Splunk collaborated on detections.
-
Crowdstrike FDR logs to Splunk vs Splunk UF collecting logs from windows member server
Our end goal is to achieve maxium coverage against MITRE mapping. Our mapping is pretty low and the management want to achieve this in a cost effective manner. Our analysts are more comfortable with creating alerts and dashboards using standard wineventlogs. When we talk about FDR, they are like "Rabitt in the headlights". We are planning to achieve by end of 2023. https://github.com/splunk/security_content/blob/develop/docs/mitre-map/coverage.png (highlighted in blue). Some of the coverage comes native with EDR and NDR. We have a different map of that one (esp proactive one).
-
threat hunting DLL search order hijacking
So you want to see if the files in this list are not running out of System32 or SysWOW64.
-
frustrated with lack of “entry level” security roles
Build a home lab. Phase 1: Get a good server to run VM's on. Use Proxmox as the hypervisor. Get a managed network switch (used ones on eBay are fine). Setup a span port or get a physical network TAP. Install Zeek and capture all the traffic in and out of your house. Look at the logs. Understand them. Use the free version of Suricata IDS. Examine the logs, understand them. Phase 2: Install Splunk (it has a free version). Push all the Zeek/Suricata logs to Splunk with the universal forwarder. Learn how to use Splunk. Learn the query language. Download APPs, analyze data, build dashboards, setup alerts (https://research.splunk.com/). Phase 3: Setup Honeypots, trigger them to learn how they work. Phase 4: Install Windows and Linux desktops and servers. Use the Splunk universal forwarder to dump all the logs into Splunk. Learn the logs, understand them!
-
Learning splunk step by step
Research Lantern
-
Has Splunk provided any Maggie Malware fix or how to detect it ?
Checkout https://research.splunk.com for stuff like this. Just be careful regarding naming, you will more likely find accurate detections searching by the CVE number.
-
Best Way to Learn Query Writing?
We have over 1,000 queries (which we refer to as detections) in our publicly-available GitHub Repository in the following folder: https://github.com/splunk/security_content/tree/develop/detections
-
Splunk Hyper Queries & other SPL nuggets for Security Teams
As for detection libraries, I find lots of people don't know about https://research.splunk.com/
-
A note from our sponsor - WorkOS
workos.com | 23 Apr 2024
Stats
splunk/security_content is an open source project licensed under Apache License 2.0 which is an OSI approved license.
The primary programming language of security_content is Python.
Popular Comparisons
- security_content VS atomic-red-team
- security_content VS sigma
- security_content VS remote-splunk-search
- security_content VS PyNite
- security_content VS nvim-splunk-linter
- security_content VS detection-rules
- security_content VS ChatGPT-4-Splunk
- security_content VS ZondaPro
- security_content VS Automata
- security_content VS threathunting-spl
Sponsored