0x4d31/awesome-threat-detection

This repository is a curated list of resources for threat detection and threat hunting, two related practices in defensive cybersecurity. Threat detection is the process of identifying when an attacker or malicious software is active inside a network or system. Threat hunting is a more proactive version of the same idea: rather than waiting for an automated alert, a security analyst actively searches through logs and system data looking for signs of compromise that automated tools may have missed. The list is organized into several sections. Tools covers open-source software that helps with detection work, broken down by category: platforms that collect logs and fire alerts, tools for monitoring individual computers, tools for monitoring network traffic, and tools for monitoring email. A separate section covers detection rules, which are written patterns that describe what suspicious activity looks like, so that detection systems know what to flag. Beyond tools, the list includes links to frameworks (structured models for understanding attacker behavior, most notably the MITRE ATT&CK framework, a widely used catalog of attack techniques), research papers, blog posts, datasets for practicing detection skills, and guides focused on specific environments such as Windows, macOS, and DNS. There are also sections for podcasts, newsletters, videos, training courses, and hands-on lab environments. A separate section covers threat simulation, which is the practice of safely recreating attacker behavior in a controlled environment to test whether your detection tools actually catch it. Tools and resources for building and running those simulations are listed there. The full README is longer than what was shown.