Detection and Response Pipeline Logo

Detection and Response Pipeline

0
Free
Visit Website

A compilation of suggested tools for each component in a detection and response pipeline, along with real-world examples. The purpose is to create a reference hub for designing effective threat detection and response pipelines. Join us, explore the curated content, and contribute to this collaborative effort. Main Components of a Detection & Response Pipeline: - Detection-as-Code Pipeline - Data Pipeline - Detection and Correlation Engine - Response Orchestration and Automation - Investigation and Case Management - Real-world Examples - Additional Resources Detection-as-Code Pipeline Tool / Service Purpose: - GitHub: Detection content development - GitLab: Detection content development - Gitea: Detection content development - AWS CodeCommit: Detection content development - GitHub Actions: CI/CD pipeline - GitLab Runner: CI/CD pipeline - Drone: CI/CD pipeline - AWS CodePipeline: CI/CD pipeline Resources: Automating Detection-as-Code: An example reference that uses GitHub for detection content development, GitHub Actions for CI/CD, Elastic as SIEM, GitHub Issues for alert management, and Tines for alert and response handling. Practical Detection-as-Code: An exa

FEATURES

ALTERNATIVES

Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.

A remediation orchestration platform that consolidates security alerts, automates triage, and streamlines the remediation process across hybrid environments.

StackStorm is an open-source automation platform that connects and automates DevOps workflows and integrates with existing infrastructure.

Incident response framework focused on remote live forensics

A panic button app for triggering a ripple effect across apps responding to panic events

A web collaborative platform for incident responders to share technical details during investigations, shipped in Docker containers for easy installation and upgrades.

Request Tracker for Incident Response (RTIR) is a tool for incident response teams to manage incident reports, correlate data, and facilitate communication.

Network Intelligence is a cybersecurity services provider offering comprehensive security solutions through their ADVISE framework, including detection and response, compliance, data privacy, and secure digital transformation services across multiple industries.

PINNED