Detection and Response Pipeline Logo

Detection and Response Pipeline

0
Free
Visit Website

A compilation of suggested tools for each component in a detection and response pipeline, along with real-world examples. The purpose is to create a reference hub for designing effective threat detection and response pipelines. Join us, explore the curated content, and contribute to this collaborative effort. Main Components of a Detection & Response Pipeline: - Detection-as-Code Pipeline - Data Pipeline - Detection and Correlation Engine - Response Orchestration and Automation - Investigation and Case Management - Real-world Examples - Additional Resources Detection-as-Code Pipeline Tool / Service Purpose: - GitHub: Detection content development - GitLab: Detection content development - Gitea: Detection content development - AWS CodeCommit: Detection content development - GitHub Actions: CI/CD pipeline - GitLab Runner: CI/CD pipeline - Drone: CI/CD pipeline - AWS CodePipeline: CI/CD pipeline Resources: Automating Detection-as-Code: An example reference that uses GitHub for detection content development, GitHub Actions for CI/CD, Elastic as SIEM, GitHub Issues for alert management, and Tines for alert and response handling. Practical Detection-as-Code: An exa

FEATURES

ALTERNATIVES

npm security team foils plot to steal $13 million in cryptocurrency

A multi-platform open source tool for triaging suspect systems and hunting for Indicators of Compromise (IOCs) across thousands of endpoints.

An open-source SOAR tool for automating threat and incident response workflows using CACAO security playbooks.

A panic button app for triggering a ripple effect across apps responding to panic events

Web-based tool for incident response with easy local installation using Docker.

A GraphQL security testing tool

CrowdStrike Falcon Orchestrator is a Windows-based application for workflow automation and security response.

A collaborative and open-source incident response platform for sharing observables among analysts.