✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
-
Updated
Jan 5, 2026
#
threat-detection
Here are 2,890 public repositories matching this topic...
-
Updated
Sep 22, 2026 - Python
Security sensor for realtime threat detection and protection
windows security instrumentation windows-kernel etw threat-hunting yara red-team security-tools malware-detection blue-team mitre-attack threat-detection endpoint-security purple-team windows-security detection-engineering endpoint-detection-response forencics
-
Updated
Sep 22, 2026 - Go
☁️ ⚡ Granular, Actionable Adversary Emulation for the Cloud
aws security aws-security cloud-security azure-security mitre-attack adversary-emulation threat-detection purple-team gcp-security kubernetes-security detection-engineering cloud-native-security
-
Updated
Sep 22, 2026 - Go
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
open-source neo4j clickhouse incident-response self-hosted cybersecurity siem soc threat-intelligence soar mitre-attack ai-security threat-detection purple-team security-operations detection-engineering alert-triage langgraph agentic-ai investigation-ledger
-
Updated
Sep 23, 2026 - Python
A curated knowledge base to build, run and mature a SOC (including CSIRT).
architecture incident-response dfir cybersecurity cert csirt threat-hunting siem tip soc risk-management ttp soar sirp mitre-attack purpleteam threat-detection security-monitoring detection-engineering
-
Updated
Sep 22, 2026
ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.
benchmark mcp cursor codex ai-agents claude ai-security threat-detection prompt-injection llm-security model-context-protocol agent-security claude-code
-
Updated
Sep 22, 2026 - Python
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
security django osint ai monitoring reactjs incident-response phishing cybersecurity certificate-transparency threat-hunting watcher misp thehive threat-intelligence certstream threat-detection huggingface cyber-ai ai-threat-intelligence
-
Updated
Sep 22, 2026 - JavaScript
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
-
Updated
Aug 3, 2026
Threat-hunting tool for Linux
-
Updated
Sep 22, 2026 - Rust
Open source platform for cyber security analysts with many features for threat intelligence and detection engineering.
-
Updated
Apr 28, 2026 - JavaScript
Repository for threat hunting and detection queries, etc. for Defender for Endpoint and Microsoft Sentinel in KQL(Kusto Query Language).
dfir cybersecurity threat-hunting threat-detection kql detection-engineering kusto-language defender-for-endpoint microsoft-sentinel
-
Updated
Aug 14, 2026 - Jupyter Notebook
A repository of KQL queries focused on threat hunting and threat detecting for Microsoft Sentinel & Microsoft XDR (Former Microsoft 365 Defender).
microsoft security sentinel threat-hunting threat-detection securitycenter kusto kql threat-hunt microsoft-365 kusto-query-language microsoft-security microsoft-sentinel kusto-query microsoft-365-security microsoft-365-defender threat-detecting microsoft-xdr microsoftxdr
-
Updated
Jun 3, 2026
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
security security-audit log-analysis incident-response compliance threat-hunting siem hipaa soc threat-analysis security-automation security-tools threat-intelligence soar soc2 malware-detection log-parsing threat-detection cmmc security-operations-center
-
Updated
Sep 22, 2026 - TypeScript
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
open-source aws devops log-analysis azure incident-response gcp forensics parquet siem mitre-attack threat-detection detections duckdb tailpipe
-
Updated
Sep 18, 2026 - Go
Open-source runtime AI agent security tool - monitors and controls AI agents, catching malicious tool use, prompt injection, and policy drift in real time, before the agent acts.
ai mcp self-hosted agents observability ai-agents ai-security threat-detection runtime-security ai-governance langchain prompt-injection llm-security langgraph agentic-ai agent-security openai-agents mcp-security aarm agentic-security
-
Updated
Sep 15, 2026 - Python
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
linux rust incident-response etw sysmon siem ebpf sigma yara security-tools linux-security malware-detection blue-team edr threat-detection security-monitoring endpoint-security windows-security detection-engineering endpoint-detection
-
Updated
Sep 21, 2026 - Rust
Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.
owasp ai-security threat-detection sigma-rules prompt-injection llm-security agent-security mcp-security garak owasp-agentic agent-threat-rules
-
Updated
Sep 22, 2026 - TypeScript
A flexible threat detection platform that simplifies rule management and deployment using K8s CronJob and Helm, but can also run standalone or with other job schedulers like Nomad.
-
Updated
Oct 1, 2024 - Go
ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.
security automation pypi cybersecurity threat-hunting siem threat-analysis security-tools threat-intelligence ai-agents threat-detection threat-response detection-engineering agentic-ai thrunting
-
Updated
Sep 22, 2026 - Python
Add this topic to your repo
To associate your repository with the threat-detection topic, visit your repo's landing page and select "manage topics."