✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
-
Updated
Jan 5, 2026
#
threat-detection
Here are 1,851 public repositories matching this topic...
-
Updated
Jul 1, 2026 - Python
☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud
aws security aws-security cloud-security azure-security mitre-attack adversary-emulation threat-detection purple-team gcp-security kubernetes-security detection-engineering cloud-native-security
-
Updated
Jul 1, 2026 - Go
A curated knowledge base to build, run and mature a SOC (including CSIRT).
architecture incident-response dfir cybersecurity cert csirt threat-hunting siem tip soc risk-management ttp soar sirp mitre-attack purpleteam threat-detection security-monitoring detection-engineering
-
Updated
Jun 30, 2026
Proactive, Open source API security → API discovery, API Security Posture, Testing in CI/CD, Test Library with 1000+ Tests, Add custom tests, Sensitive data exposure
security authentication authorization api-testing hacktoberfest api-discovery owasp-top-10 devsecops security-testing api-security sensitive-data-exposure threat-detection idor devsecops-pipeline hacktoberfest2023 api-security-testing api-security-posture
-
Updated
Jul 1, 2026 - Java
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
open-source neo4j clickhouse incident-response self-hosted cybersecurity siem soc threat-intelligence soar mitre-attack ai-security threat-detection purple-team security-operations detection-engineering alert-triage langgraph agentic-ai investigation-ledger
-
Updated
Jun 30, 2026 - Python
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
security django osint ai monitoring reactjs incident-response phishing cybersecurity certificate-transparency threat-hunting watcher misp thehive threat-intelligence certstream threat-detection huggingface cyber-ai ai-threat-intelligence
-
Updated
Jul 1, 2026 - JavaScript
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
-
Updated
Jun 18, 2026
Threat-hunting tool for Linux
-
Updated
Jun 9, 2026 - Rust
Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.
-
Updated
Apr 28, 2026 - JavaScript
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
dfir cybersecurity threat-hunting threat-detection kql detection-engineering kusto-language defender-for-endpoint microsoft-sentinel
-
Updated
Jan 14, 2026 - Jupyter Notebook
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
microsoft security sentinel threat-hunting threat-detection securitycenter kusto kql threat-hunt microsoft-365 kusto-query-language microsoft-security microsoft-sentinel kusto-query microsoft-365-security microsoft-365-defender threat-detecting microsoft-xdr microsoftxdr
-
Updated
Jun 3, 2026
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
security security-audit log-analysis incident-response compliance threat-hunting siem hipaa soc threat-analysis security-automation security-tools threat-intelligence soar soc2 malware-detection log-parsing threat-detection cmmc security-operations-center
-
Updated
Jul 1, 2026 - TypeScript
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
open-source aws devops log-analysis azure incident-response gcp forensics parquet siem mitre-attack threat-detection detections duckdb tailpipe
-
Updated
Jun 23, 2026 - Go
Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.
linux rust incident-response etw sysmon siem ebpf sigma yara security-tools linux-security malware-detection blue-team edr threat-detection security-monitoring endpoint-security windows-security detection-engineering endpoint-detection
-
Updated
Jun 29, 2026 - Rust
A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.
-
Updated
Oct 1, 2024 - Go
Community Security Analytics provides a set of community-driven audit & threat queries for Google Cloud
bigquery security logging gcp google-cloud audit-logs network-analysis chronicle log-analytics network-logs threat-detection security-operations cloud-security-command-center
-
Updated
Jun 12, 2024 - Python
Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.
ai mcp self-hosted agents observability ai-agents ai-security threat-detection runtime-security ai-governance langchain prompt-injection llm-security langgraph agentic-ai agent-security openai-agents mcp-security aarm agentic-security
-
Updated
Jul 1, 2026 - Python
A datasource assessment on an event level to show potential coverage or the MITRE ATT&CK framework
-
Updated
Nov 3, 2020 - PowerShell
Threatest is a CLI and Go framework for end-to-end testing threat detection rules.
-
Updated
Jun 19, 2026 - Go
Improve this page
Add a description, image, and links to the threat-detection topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the threat-detection topic, visit your repo's landing page and select "manage topics."