christopherwatkins901 Goto Github PK

alerting-detection-strategy-framework

A framework for developing alerting and detection strategies for incident response.

amazon-security-lake-quicksight

Deploying QuickSight with AWS Security Lake

aws-cheatsheet-ir

A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.

aws-cloudtrail-lake-github-audit-log

A reference architecture to integrate GitHub Audit Log to AWS CloudTrail Lake

aws-cloudtrail-lake-okta-system-log-events

AWS Cloudtrail lake Okta integration

aws-incident-response-athena-searches

aws-incident-response-athena-searches

aws-incident-response-playbooks-workshop

SIRT_Playbook_Template

aws-security-analytics-bootstrap

AWS Security Analytics Bootstrap enables customers to perform security investigations on AWS service logs by providing an Amazon Athena analysis environment that's quick to deploy, ready to use, and easy to maintain.

awsgoat

AWSGoat : A Damn Vulnerable AWS Infrastructure

cloud-security-attacks

Azure and AWS Attacks

dac-purple-teaming-workshop

SIRT_Panther_DAC_Workshop

jupyter-notebook-for-incident-response

A library of Incident Response notebooks using Jupyter. We will show how you can leverage pre-defined notebook files to guide your incident responders in identifying, containing, eradicating, and recovering from an incident.

matano

Open source cloud-native security lake platform (SIEM alternative) for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

panther-analysis

Panther detection rules and policies

sec-it-dart-main

siem-on-amazon-opensearch-service

A solution for collecting, correlating and visualizing multiple types of logs to help investigate security incidents.

sigma2athena-aws

This repository contains the research and components of our research into using Sigma for AWS Incident Response.

sigma_aws_rules

Main Rule Repository

substation

Substation is a cloud-native, event-driven data pipeline toolkit designed for security and observability teams.