Open Threat Research Forge ORG

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

Re-play Security Events

Open Source Security Events Metadata (OSSEM)

Building environments to replicate small networks and deploy applications

Microsoft Sentinel2Go is an open source project developed to expedite the deployment of a Microsoft Sentinel research lab.

The Infosec Community Definitive Guide to Jupyter Notebooks

Python Script to access ATT&CK content available in STIX via a public TAXII server

OSSEM Detection Model

Place for resources used during the Mordor Detection hackathon event featuring APT29 ATT&CK evals datasets

Cloud Templates and scripts to deploy mordor environments

A community event for security researchers to share their favorite notebooks

No description.

Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity

A collection of notebooks built for defensive and offensive operations.

A repo to document API functions mapped to security events across diverse platforms

OSSEM Data Dictionaries

OSSEM Common Data Model

BloodHound Cypher Queries Ported to a Jupyter Notebook

No description.

Notebooks created to attack and secure Active Directory environments

Repo to track SANS BlueTeam Summit Presentation

No description.

Generic Signature Format for SIEM Systems

Writing Your Own Ticket to the Cloud Like APT: A Deep-dive to AD FS Attacks, Detections, and Mitigations

Microsoft Entra ID Administration LLM-based Autonomous Agent

Materiales para enseñar lo básico de Jupyter Notebooks y análisis de data con Pandas

Official OTR Blog Website

A refreshed version of Hyde for Jekyll 3.x and 4.x

Slides

An extension of the OSSEM-DD repository.