SEC
Security desk
Hashes, encodings, headers, and checks you would rather run yourself. Nothing here asks for an account.
745–768 / 915
Google SecOps Large Outbound Data Transfer Detection Generator
LiveGenerate a tuned Google SecOps detection for large outbound data transfer with field mapping and false-positive guidance
Open toolGoogle SecOps DNS Tunneling Detection Generator
LiveGenerate a tuned Google SecOps detection for dns tunneling with field mapping and false-positive guidance
Open toolGoogle SecOps Firewall Deny Spike Detection Generator
LiveGenerate a tuned Google SecOps detection for firewall deny spike with field mapping and false-positive guidance
Open toolGoogle SecOps Web Attack Patterns Detection Generator
LiveGenerate a tuned Google SecOps detection for web attack patterns with field mapping and false-positive guidance
Open toolGoogle SecOps Security Group Change Detection Generator
LiveGenerate a tuned Google SecOps detection for security group change with field mapping and false-positive guidance
Open toolGoogle SecOps Lateral Movement via PsExec Detection Generator
LiveGenerate a tuned Google SecOps detection for lateral movement via psexec with field mapping and false-positive guidance
Open toolGoogle SecOps Pass-the-Hash Detection Generator
LiveGenerate a tuned Google SecOps detection for pass-the-hash with field mapping and false-positive guidance
Open toolGoogle SecOps Registry Run Key Persistence Detection Generator
LiveGenerate a tuned Google SecOps detection for registry run key persistence with field mapping and false-positive guidance
Open toolGoogle SecOps Unusual Parent-Child Process Detection Generator
LiveGenerate a tuned Google SecOps detection for unusual parent-child process with field mapping and false-positive guidance
Open toolWazuh Firewall Deny Spike Detection Generator
LiveGenerate a tuned Wazuh detection for firewall deny spike with field mapping and false-positive guidance
Open toolSigma Firewall Deny Spike Detection Generator
LiveGenerate a tuned Sigma detection for firewall deny spike with field mapping and false-positive guidance
Open toolCrowdStrike Falcon LogScale Firewall Deny Spike Detection Generator
LiveGenerate a tuned CrowdStrike Falcon LogScale detection for firewall deny spike with field mapping and false-positive guidance
Open toolSumo Logic Brute Force Login Detection Generator
LiveGenerate a tuned Sumo Logic detection for brute force login with field mapping and false-positive guidance
Open toolSumo Logic Password Spray Detection Generator
LiveGenerate a tuned Sumo Logic detection for password spray with field mapping and false-positive guidance
Open toolSumo Logic New Admin Account Created Detection Generator
LiveGenerate a tuned Sumo Logic detection for new admin account created with field mapping and false-positive guidance
Open toolSumo Logic Privileged Group Membership Change Detection Generator
LiveGenerate a tuned Sumo Logic detection for privileged group membership change with field mapping and false-positive guidance
Open toolSumo Logic Security Log Cleared Detection Generator
LiveGenerate a tuned Sumo Logic detection for security log cleared with field mapping and false-positive guidance
Open toolSumo Logic Suspicious PowerShell Execution Detection Generator
LiveGenerate a tuned Sumo Logic detection for suspicious powershell execution with field mapping and false-positive guidance
Open toolSumo Logic Ransomware File Activity Detection Generator
LiveGenerate a tuned Sumo Logic detection for ransomware file activity with field mapping and false-positive guidance
Open toolSumo Logic Cloud Admin Login Without MFA Detection Generator
LiveGenerate a tuned Sumo Logic detection for cloud admin login without mfa with field mapping and false-positive guidance
Open toolSumo Logic Mailbox Forwarding Rule Created Detection Generator
LiveGenerate a tuned Sumo Logic detection for mailbox forwarding rule created with field mapping and false-positive guidance
Open toolSumo Logic Credential Dumping (LSASS Access) Detection Generator
LiveGenerate a tuned Sumo Logic detection for credential dumping (lsass access) with field mapping and false-positive guidance
Open toolNIST SP 800-53 Policy Pack Generator
LivePolicy Pack Generator for NIST SP 800-53, pre-filled with the framework's requirements and exportable
Open toolNIST SP 800-53 Training Requirements Checklist
LiveTraining Requirements Checklist for NIST SP 800-53, pre-filled with the framework's requirements and exportable
Open tool