Microsoft Sentinel Security Playbooks
This repo contains sample security playbooks for security automation, orchestration and response (SOAR). Each folder contains a security playbook ARM template that uses Microsoft Sentinel trigger. Instructions for deploying a custom template: After selecting a playbook, in the Azure portal: Search for deploy a custom template Click build your own template in the editor Paste the contents from the GitHub playbook Click Save Fill in needed data and click Purchase Once deployment is complete, you will need to authorize each connection. Click the Microsoft Sentinel connection resource Click edit API connection Click Authorize Click Save Repeat steps for other connections. For Azure Log Analytics Data Collector, you will need to add the workspace ID and Key. You can now edit the playbook in Logic apps. Instructions for templatizing a playbook: Option 1: Azure Logic App/Playbook ARM Template Generator Download tool and run the PowerShell script Extract the folder and open "Playbook_ARM_Template_Generator.ps1" either in Visual Studio Code/Windows PowerShell/PowerShell Core Note The script runs from the user's machine. You must allow PowerShell script execution. To do so, run the
FEATURES
ALTERNATIVES
A report on detecting lateral movement through tracking event logs, updated to include analysis of various tools and commands used by attackers.
Incident response framework focused on remote live forensics
A data curation platform that automates security data collection, transformation and routing while reducing data volume and infrastructure costs.
Dispatch helps manage security incidents by integrating with existing tools and automating incident response tasks.
A framework for accumulating, describing, and classifying actionable Incident Response techniques
Automatically configure your app to follow OWASP security patterns and principles with Nuxt Security module.
WALKOFF is an automation framework for integrating capabilities and devices to streamline tasks.
A project that uses Athena and EventBridge to investigate API activity and notify of actions for incident response and misconfiguration detection.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Kriptos
An AI-driven data classification and governance platform that automatically discovers, analyzes, and labels sensitive information while providing risk management and compliance capabilities.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.