AttackRuleMap
AttackRuleMap (ARM) is a mapping tool that correlates open-source detection rules and atomic tests to help security teams understand detection coverage. The tool provides a comprehensive mapping between: - MITRE ATT&CK techniques and tactics - Atomic Red Team test cases - Sigma detection rules - Splunk detection rules Key capabilities include: - Mapping of atomic test cases to corresponding detection rules - Cross-referencing between different detection rule formats - Platform-specific detection coverage analysis - Identification of gaps in detection capabilities - Support for Windows, Linux and ESXi platforms The mapping data is organized in a tabular format containing: - Technique IDs - Atomic attack names and GUIDs - Platform information - Associated Sigma rules - Corresponding Splunk detection rules This correlation helps security teams: - Validate detection coverage against known attack techniques - Identify areas requiring additional detection rules - Plan and prioritize detection engineering efforts - Test detection capabilities using mapped atomic tests
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A comprehensive Threat Intelligence Program Management Solution for managing the entire CTI lifecycle.
The Trystero Project is a threat intelligence platform that measures email security efficacy and provides various tools and resources, while VMware Carbon Black offers endpoint protection and workload security solutions.
A project that detects malicious SSL connections by identifying and blacklisting SSL certificates used by botnet C&C servers and identifying JA3 fingerprints to detect and block malware botnet C&C communication.
In-depth threat intelligence reports and services providing insights into real-world intrusions, malware analysis, and threat briefs.
FraudGuard is a service that provides real-time internet traffic analysis and IP tracking to help validate usage and prevent fraud.
A collection of companies that disclose adversary TTPs after being breached, useful for analysis of intrusions.
VirusTotal API v3 is a threat intelligence platform for scanning files, URLs, and IP addresses, and retrieving reports on threat reputation and context.
Malware Patrol offers a range of threat intelligence solutions, including enterprise data feeds, DNS firewall, phishing threat intelligence, and small business protection.
ThreatMiner is a threat intelligence portal that aggregates data from various sources and provides contextual information related to indicators of compromise (IOCs).
PINNED
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.