Popular repositories

1. Windows-auditing-mindmap Public

   Set of Mindmaps providing a detailed overview of the different #Windows auditing capacities and event log files.

   456 90

2. EVTX-to-MITRE-Attack Public

   Set of EVTX samples (>170) mapped to MITRE Att@k tactic and techniques to measure your SIEM coverage or developed new use cases.

   75 18

3. SIGMA-detection-rules Public

   Set of SIGMA rules (>250) mapped to MITRE Att@k tactic and techniques

   28 10

4. windows-event-forwarding Public

   Forked from palantir/windows-event-forwarding

   A repository for using windows event forwarding for incident detection and response

   Roff 4

5. Windows-WEC-server_auto-deploy Public

   PowerShell scripts for fast Windows Event Collector configuration with Palantir toolset

   PowerShell 4 2

6. sysmon-config Public

   Forked from Neo23x0/sysmon-config

   Sysmon configuration file template with default high-quality event tracing

   1