Detection and Response Pipeline Logo

Detection and Response Pipeline

0
Free
Visit Website

A compilation of suggested tools for each component in a detection and response pipeline, along with real-world examples. The purpose is to create a reference hub for designing effective threat detection and response pipelines. Join us, explore the curated content, and contribute to this collaborative effort. Main Components of a Detection & Response Pipeline: - Detection-as-Code Pipeline - Data Pipeline - Detection and Correlation Engine - Response Orchestration and Automation - Investigation and Case Management - Real-world Examples - Additional Resources Detection-as-Code Pipeline Tool / Service Purpose: - GitHub: Detection content development - GitLab: Detection content development - Gitea: Detection content development - AWS CodeCommit: Detection content development - GitHub Actions: CI/CD pipeline - GitLab Runner: CI/CD pipeline - Drone: CI/CD pipeline - AWS CodePipeline: CI/CD pipeline Resources: Automating Detection-as-Code: An example reference that uses GitHub for detection content development, GitHub Actions for CI/CD, Elastic as SIEM, GitHub Issues for alert management, and Tines for alert and response handling. Practical Detection-as-Code: An exa

FEATURES

ALTERNATIVES

npm security team foils plot to steal $13 million in cryptocurrency

Datadog offers a comprehensive suite of cybersecurity tools for various aspects of application and infrastructure monitoring.

A defense-in-depth security automation and monitoring framework utilizing threat intelligence, machine learning, and serverless technologies.

Scumblr is a web application for periodic syncs of data sources and security analysis to streamline proactive security.

Detect signed malware and track stolen code-signing certificates using osquery.

An open-source, drag-and-drop security workflow builder with integrated case management for automating security workflows and tackling alert fatigue.

A report on detecting lateral movement through tracking event logs, updated to include analysis of various tools and commands used by attackers.

A standardized framework for describing and classifying cybersecurity incidents