AttackRuleMap
AttackRuleMap (ARM) is a mapping tool that correlates open-source detection rules and atomic tests to help security teams understand detection coverage. The tool provides a comprehensive mapping between: - MITRE ATT&CK techniques and tactics - Atomic Red Team test cases - Sigma detection rules - Splunk detection rules Key capabilities include: - Mapping of atomic test cases to corresponding detection rules - Cross-referencing between different detection rule formats - Platform-specific detection coverage analysis - Identification of gaps in detection capabilities - Support for Windows, Linux and ESXi platforms The mapping data is organized in a tabular format containing: - Technique IDs - Atomic attack names and GUIDs - Platform information - Associated Sigma rules - Corresponding Splunk detection rules This correlation helps security teams: - Validate detection coverage against known attack techniques - Identify areas requiring additional detection rules - Plan and prioritize detection engineering efforts - Test detection capabilities using mapped atomic tests
FEATURES
ALTERNATIVES
SeaSponge is an accessible web-based threat modeling tool with a focus on accessibility, aesthetics, and intuitive user experience.
Hippocampe is a threat feed aggregator with configurable confidence levels and a Hipposcore for determining maliciousness.
A free and open-source OSINT framework for gathering and analyzing data from various sources
Aggregates security threats from online sources and outputs to various formats.
A threat intelligence dissemination layer for open-source security tools with STIX-2 support and plugin-based architecture.
Create deceptive webpages to deceive and redirect attackers away from real websites by cloning them.
Container of 200 Windows EVTX samples for testing detection scripts and training on DFIR.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Kriptos
An AI-driven data classification and governance platform that automatically discovers, analyzes, and labels sensitive information while providing risk management and compliance capabilities.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.