Popular repositories Loading

1. detection-coverage-audit detection-coverage-audit Public

   Finds ATT&CK techniques covered on paper but blind in production by joining rules to observed telemetry.

   Python

2. alert-triage-economics alert-triage-economics Public

   Replays labelled alert streams to measure what each tuning change costs in missed true positives.

   Python

3. iam-blast-radius iam-blast-radius Public

   Computes IAM privilege reachability to show which least-privilege roles still reach administrative actions.

   Python

4. detection-rule-gate detection-rule-gate Public

   Fails a detection-as-code pull request when a Sigma rule is unmapped, unbounded or undocumented.

   Python

5. intel-enrichment-cache intel-enrichment-cache Public

   Rate limit aware threat intel client with caching, request coalescing and quota aware hedging.

   Python

6. nilay-dave nilay-dave Public