detection-engineering 开源项目推荐（2,566 个）

beenuar /AiSOC

开源 AI 安全运营中心：告警融合、LLM 智能体分诊、MITRE ATT&CK 调查，以及可回放的决策账本，记录每个智能体步骤。可自托管，无需 API 密钥即可运行，MIT 许可。附带适用于 Claude、Cursor 和 Continue 的 MCP 服务器。

Asymptote-Labs /agent-beacon

The cross-harness, self-improving memory layer for AI agents. Join our community: https://discord.com/invite/zdNChS2fBu

mikeroyal /Digital-Forensics-Guide

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

jiwoochris /artex-global

Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)

sbousseaden /EVTX-ATTACK-SAMPLES

Windows Events Attack Samples

rabbitstack /fibratus

Security sensor for realtime threat detection and protection

DataDog /stratus-red-team

☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud

mthcht /awesome-lists

优秀的SOC/CERT/CTI安全列表

cyb3rxp /awesome-soc

A curated knowledge base to build, run and mature a SOC (including CSIRT).

splunk /security_content

Splunk Security Content

matanolabs /matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

BushidoUK /Ransomware-Tool-Matrix

A resource containing all the tools each ransomware gangs uses

infosecB /awesome-detection-engineering

检测工程是网络安全防御计划的一项战术功能，涉及检测控制的设计、实施和操作，目标是在恶意或未经授权的活动对个人或组织产生负面影响之前主动识别该活动。

mikeroyal /Open-Source-Security-Guide

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

mvelazc0 /PurpleSharp

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

Cyb3r-Monk /Threat-Hunting-and-Detection

Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).

runreveal /pql

Pipelined Query Language

mthcht /ThreatHunting-Keywords

Awesome list of keywords and artifacts for Threat Hunting sessions

Karib0u /rustinel

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

MHaggis /Security-Detections-MCP

MCP to help Defenders Detection Engineer Harder and Smarter