bookmarks.html

<!--Generated datetime: 2026-03-23 11:09:34-->
<!DOCTYPE NETSCAPE-Bookmark-file-1>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
<TITLE>Browser Bookmarks</TITLE>
<H1>{escape(title)}</H1>
<DL><p>
  <DT><H3>Awesome Detection Engineer</H3>
  <DL><p>
    <DT><H3>Detection Rules</H3>
    <DL><p>
      <DT><A HREF="https://github.com/anvilogic-forge/armory/tree/main/detections">Anvilogic Detection Armory</A>
      <DT><A HREF="https://attackrulemap.com/">Attack Rule Map</A>
      <DT><A HREF="https://github.com/chronicle/detection-rules">Chronicle (GCP) Rules</A>
      <DT><A HREF="https://docs.datadoghq.com/security/default_rules/#all">Datadog Detections</A>
      <DT><A HREF="https://detectioncode.com/">DetectionCode</A>
      <DT><A HREF="https://elastic.github.io/detection-rules-explorer">Elastic Detection Rules Explorer</A>
      <DT><A HREF="https://www.elastic.co/guide/en/security/current/prebuilt-rules.html">Elastic Rules</A>
      <DT><A HREF="https://github.com/elastic/detection-rules/tree/main/rules">Elastic Rules GitHub Repository</A>
      <DT><A HREF="https://github.com/elastic/protections-artifacts/tree/main">Elastic Security for Endpoint Rules</A>
      <DT><A HREF="https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_2/rules/rule_descriptions.htm">FortiSIEM Rules</A>
      <DT><A HREF="https://github.com/GoogleCloudPlatform/security-analytics">Google Cloud Platform (GCP) Community Security Analytics</A>
      <DT><A HREF="https://github.com/0xAnalyst/DefenderATPQueries">KQL Queries for DefenderATP | 0xAnalyst</A>
      <DT><A HREF="https://github.com/reprise99/Sentinel-Queries">KQL Queries for Sentinel | reprise99</A>
      <DT><A HREF="https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/tree/main">KQL Queries | Bert-JanP</A>
      <DT><A HREF="https://github.com/Cyb3r-Monk/Threat-Hunting-and-Detection/tree/main">KQL Queries | Cyb3r Monk</A>
      <DT><A HREF="https://github.com/cyb3rmik3/KQL-threat-hunting-queries">KQL Queries | cyb3rmik3</A>
      <DT><A HREF="https://github.com/FalconForceTeam/FalconFriday/tree/master">KQL Queries | FalconForce</A>
      <DT><A HREF="https://github.com/SecurityAura/DE-TH-Aura">KQL Queries | SecurityAura</A>
      <DT><A HREF="https://github.com/SlimKQL/Hunting-Queries-Detection-Rules">KQL Queries | SlimKQL</A>
      <DT><A HREF="https://www.kqlsearch.com/">KQL Search</A>
      <DT><A HREF="https://docs.logpoint.com/docs/alert-rules/en/latest/index.html">LogPoint Rules</A>
      <DT><A HREF="https://car.mitre.org/">MITRE Cyber Analytics Repository (CAR)</A>
      <DT><A HREF="https://car.mitre.org/coverage/">MITRE Cyber Analytics Repository (CAR) Coverage Comparison</A>
      <DT><A HREF="https://rulehound.com/rules">Rulehound</A>
      <DT><A HREF="https://github.com/Azure/Azure-Sentinel/tree/master/Detections">Sentinel Detections</A>
      <DT><A HREF="https://github.com/Azure/Azure-Sentinel/tree/master/Solutions">Sentinel Solution Rules</A>
      <DT><A HREF="https://github.com/SigmaHQ/sigma">Sigma Rules</A>
      <DT><A HREF="https://github.com/mthcht/ThreatHunting-Keywords-sigma-rules/tree/main/sigma_rules/offensive_tools">Sigma Rules Threat Hunting Keywords | mthcht</A>
      <DT><A HREF="https://github.com/Inovasys-CS/EDI/tree/main">Sigma Rules | Inovasys-CS</A>
      <DT><A HREF="https://github.com/joesecurity/sigma-rules/tree/master/rules">Sigma Rules | JoeSecurity</A>
      <DT><A HREF="https://github.com/mbabinski/Sigma-Rules/tree/main">Sigma Rules | mbabinski</A>
      <DT><A HREF="https://github.com/mdecrevoisier/SIGMA-detection-rules">Sigma Rules | mdecrevoisier</A>
      <DT><A HREF="https://github.com/RussianPanda95/Sigma-Rules">Sigma Rules | RussianPanda95</A>
      <DT><A HREF="https://github.com/tsale/Sigma_rules/tree/main">Sigma Rules | tsale</A>
      <DT><A HREF="https://github.com/Yamato-Security/hayabusa-rules/tree/main/sigma">Sigma Rules | Yamato Security</A>
      <DT><A HREF="https://snapattack.com/">SnapAttack</A>
      <DT><A HREF="https://socprime.com/">SOC Prime</A>
      <DT><A HREF="https://research.splunk.com/detections/">Splunk Rules</A>
      <DT><A HREF="https://github.com/splunk/security_content/tree/develop/detections">Splunk Rules GitHub Repository</A>
      <DT><A HREF="https://github.com/wazuh/wazuh/tree/master/ruleset">Wazuh Ruleset</A>
    </DL><p>
    <DT><H3>Detection Logic</H3>
    <DL><p>
      <DT><A HREF="https://www.picussecurity.com/hubfs/Threat%20Readiness%20-%20Active%20Directory%20Ebook%20-%20Q123/Picus-The-Complete-Active-Directory-Security-Handbook.pdf">Active Directory Detection Logic | Picus</A>
      <DT><A HREF="https://adsecurity.org/?page_id=4031">Active Directory Security (adsecurity.org)</A>
      <DT><A HREF="https://www.nextron-systems.com/?s=antivirus">Antivirus Cheatsheet | Nextron Systems</A>
      <DT><A HREF="https://github.com/mthcht/awesome-lists/tree/main/Lists">Awesome Lists | mthcht</A>
      <DT><A HREF="https://adsecurity.org/wp-content/uploads/2017/04/2017-BSidesCharm-DetectingtheElusive-ActiveDirectoryThreatHunting-Final.pdf">Detecting the Elusive Active Directory Threat Hunting</A>
      <DT><A HREF="https://medium.com/@noah_h/offensive-kerberos-techniques-for-detection-engineering-16a81483f676">Offensive Kerberos Techniques for Detection Engineering | Noah</A>
      <DT><A HREF="https://jpcertcc.github.io/ToolAnalysisResultSheet">Tool Analysis Results Sheet | jpcertcc</A>
    </DL><p>
    <DT><H3>Attack Samples</H3>
    <DL><p>
      <DT><A HREF="https://github.com/splunk/attack_data">Attack Data | Splunk</A>
      <DT><A HREF="https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES">EVTX Attack Samples</A>
      <DT><A HREF="https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack">EVTX to MITRE Attack</A>
      <DT><A HREF="https://malware-traffic-analysis.net/">malware-traffic-analysis.net</A>
      <DT><A HREF="https://github.com/UraSecTeam/mordor">Mordor Dataset</A>
      <DT><A HREF="https://www.netresec.com/?page=PcapFiles">NetreSec PCAPs</A>
      <DT><A HREF="https://github.com/sbousseaden/PCAP-ATTACK">PCAP-ATTACK | sbousseaden</A>
      <DT><A HREF="https://secrepo.com/">Secrepo</A>
      <DT><A HREF="https://github.com/OTRF/Security-Datasets/tree/master/datasets">Security Datasets</A>
    </DL><p>
    <DT><H3>Detection Tests and Emulation Tools</H3>
    <DL><p>
      <DT><A HREF="https://www.picussecurity.com/hubfs/Threat%20Readiness%20-%20Active%20Directory%20Ebook%20-%20Q123/Picus-The-Complete-Active-Directory-Security-Handbook.pdf">Active Directory Attack Tests | Picus</A>
      <DT><A HREF="https://github.com/NextronSystems/APTSimulator#apt-simulator">APT Simulator</A>
      <DT><A HREF="https://github.com/redcanaryco/atomic-red-team/tree/master/atomics">Atomic Red Team | Red Canary</A>
      <DT><A HREF="https://github.com/Orange-Cyberdefense/GOAD">Game of Active Directory Lab | Orange CyberDefense</A>
      <DT><A HREF="https://hackingthe.cloud">HackingTheCloud</A>
      <DT><A HREF="https://github.com/guardicore/monkey#infection-monkey">Infection Monkey</A>
      <DT><A HREF="https://lolbas-project.github.io/">LOLBAS Project</A>
      <DT><A HREF="https://lolol.farm/">LOLOL Farm</A>
      <DT><A HREF="https://github.com/n0dec/MalwLess">MalwLess Simulation Tool (MST)</A>
      <DT><A HREF="https://caldera.mitre.org/">MITRE Caldera</A>
      <DT><A HREF="https://github.com/alphasoc/flightsim#network-flight-simulator">Network Flight Simulator</A>
      <DT><A HREF="https://github.com/alphasoc/flightsim">Network Flight Simulator</A>
      <DT><A HREF="https://rtt.secdude.de/">rtt.secdude.de</A>
      <DT><A HREF="https://github.com/DataDog/stratus-red-team">Stratus Red Team | DataDog</A>
    </DL><p>
    <DT><H3>Logging Configuration and Best Practices</H3>
    <DL><p>
      <DT><A HREF="https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#logformat">Apache Logging Configuration</A>
      <DT><A HREF="https://github.com/Neo23x0/auditd/blob/master/audit.rules">Auditd Logging Configuration | Neo23x0</A>
      <DT><A HREF="https://blog.nviso.eu/2024/09/05/validate-your-windows-audit-policy-configuration-with-kql/">KQL Query for Validating your Windows Audit Policy</A>
      <DT><A HREF="https://www.malwarearchaeology.com/cheat-sheets">Malware Archaeology Cheatsheets for Windows</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/monitoring-active-directory-for-signs-of-compromise">Microsoft Monitoring Active Directory</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-policy-recommendations">Microsoft Windows Audit Policy Recommendations</A>
      <DT><A HREF="https://docs.nginx.com/nginx/admin-guide/monitoring/logging/#setting-up-the-access-log">NGINX Configuring Access Log</A>
      <DT><A HREF="https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html">OWASP Cheatsheet</A>
      <DT><A HREF="https://github.com/olafhartong/sysmon-modular">Sysmon Configuration | Olaf Hartong</A>
      <DT><A HREF="https://github.com/SwiftOnSecurity/sysmon-config">Sysmon Configuration | SwiftOnSecurity</A>
    </DL><p>
    <DT><H3>Event Log References</H3>
    <DL><p>
      <DT><A HREF="https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes#aadsts-error-codes">AADSTS Error Codes</A>
      <DT><A HREF="https://httpd.apache.org/docs/2.4/mod/mod_log_config.html">Apache Custom Log Format</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0">Azure SigninLogs Risk Detection</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs">Azure SigninLogs Schema</A>
      <DT><A HREF="https://campus.barracuda.com/product/cloudgenfirewall/doc/172623663/available-log-files-and-structure">Barracuda Firewall Log Files Structure and Log Fields</A>
      <DT><A HREF="https://campus.barracuda.com/product/webapplicationfirewall/doc/168312817/log-formats">Barracuda Web Application Firewall Log Format</A>
      <DT><A HREF="https://campus.barracuda.com/product/webapplicationfirewall/doc/168312823/exporting-log-formats">Barracuda Web Application Firewall Log Formats</A>
      <DT><A HREF="https://campus.barracuda.com/product/websecuritygateway/doc/168742383/syslog-and-the-barracuda-web-security-gateway/">Barracuda Web Security Gateway Log Fields</A>
      <DT><A HREF="https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/7-4/getting-started/page-help-administration/page-help-logging/log-formats.html">Broadcom Edge Secure Web Gateway (Bluecoat) Access Log Format</A>
      <DT><A HREF="https://sitereview.bluecoat.com/#/category-descriptions">Broadcom Edge Secure Web Gateway (Bluecoat) Categories</A>
      <DT><A HREF="https://knowledge.broadcom.com/external/article/155205/external-logging-settings-and-log-event.html">Broadcom Endpoint Protection Manager Log Format</A>
      <DT><A HREF="https://support.checkpoint.com/results/sk/sk144192">Check Point Firewall Log Fields</A>
      <DT><A HREF="https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog.html">Cisco ASA Event IDs</A>
      <DT><A HREF="https://www.cisco.com/c/en/us/td/docs/security/esa/esa15-0/user_guide/b_ESA_Admin_Guide_15-0/b_ESA_Admin_Guide_12_1_chapter_0100111.html">Cisco ESA Log Types</A>
      <DT><A HREF="https://docs.umbrella.com/deployment-umbrella/docs/new-content-category-definitions">Cisco Umbrella Content Categories</A>
      <DT><A HREF="https://docs.umbrella.com/deployment-umbrella/docs/dns-log-formats">Cisco Umbrella DNS Log Format</A>
      <DT><A HREF="https://docs.umbrella.com/deployment-umbrella/docs/proxy-log-formats">Cisco Umbrella Proxy Log Format</A>
      <DT><A HREF="https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_010111.html#con_1679851">Cisco WSA Access Log Fields</A>
      <DT><A HREF="https://www.cisco.com/c/en/us/products/collateral/security/web-security-appliance/datasheet_C78-718442.html">Cisco WSA Filtering Categories</A>
      <DT><A HREF="https://eventlog-compendium.streamlit.app/">Eventlog Compendium</A>
      <DT><A HREF="https://www.fortiguard.com/encyclopedia?type=ips">FortiGate FortiGuard Encyclopedia</A>
      <DT><A HREF="https://docs.fortinet.com/document/fortigate/7.6.1/fortios-log-message-reference/357866/log-message-fields">FortiGate FortiOS Log Fields</A>
      <DT><A HREF="https://docs.fortinet.com/document/fortigate/7.6.1/fortios-log-message-reference/160372/list-of-log-types-and-subtypes">FortiGate FortiOS Log Types and Subtypes</A>
      <DT><A HREF="https://cloud.google.com/security-command-center/docs/concepts-security-sources#threats">GCP Threat Detection Findings</A>
      <DT><A HREF="https://docs.github.com/en/enterprise-server@3.18/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise">GitHub Event IDs</A>
      <DT><A HREF="https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html">GuardDuty Finding Types</A>
      <DT><A HREF="https://www.hackthelogs.com/">HackTheLogs</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525807(v=vs.90">IIS Log File Format</A>
      <DT><A HREF="https://docs.imperva.com/bundle/v15.3-waf-system-events-reference-guide/page/63179.htm">Imperva Event Types</A>
      <DT><A HREF="https://docs.imperva.com/bundle/cloud-application-security/page/more/log-file-structure.htm">Imperva Log Fields</A>
      <DT><A HREF="https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/system-logging-for-a-security-device.html">Juniper Junos OS Log Fields</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus">Microsoft Defender Event IDs</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference">Microsoft Defender for Cloud Alert References</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/defender-for-identity/alerts-overview">Microsoft Defender for Identity Alert References</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables">Microsoft Defender XDR Schemas</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn800669(v=ws.11">Microsoft DNS Debug Event IDs</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes">Microsoft Entra authentication and authorization error codes</A>
      <DT><A HREF="https://login.microsoftonline.com/error">Microsoft Errors Search</A>
      <DT><A HREF="https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log">NGINX Access Log Format</A>
      <DT><A HREF="https://applipedia.paloaltonetworks.com/">Palo Alto PAN-OS Applications</A>
      <DT><A HREF="https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions">Palo Alto PAN-OS Log Fields</A>
      <DT><A HREF="https://docs.paloaltonetworks.com/advanced-threat-prevention/administration/threat-prevention/threat-signature-categories">Palo Alto PAN-OS Threat Categories</A>
      <DT><A HREF="https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf">SonicWall SonicOS Log Events Documentation</A>
      <DT><A HREF="https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/LogsReports/Logs/Events/EventTypes/index.html#runtime-detections">Sophos Central Admin Events</A>
      <DT><A HREF="https://docs.sophos.com/nsg/sophos-firewall/19.5/PDF/SF-syslog-guide-19.5.pdf">Sophos Firewall Log Documentation</A>
      <DT><A HREF="https://wiki.squid-cache.org/SquidFaq/SquidLogs">Squid Log Fields and Log Types</A>
      <DT><A HREF="https://wiki.squid-cache.org/Features/LogFormat">Squid Log Format</A>
      <DT><A HREF="https://docs.suricata.io/en/latest/output/eve/eve-json-format.html">Suricata Log Format</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#events">Sysmon Event IDs</A>
      <DT><A HREF="https://www.watchguard.com/help/docs/fireware/12/en-US/log_catalog/12_11_Log-Catalog.pdf">WatchGuard Fireware OS Log Format</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings">Windows Event IDs and Audit Policies</A>
      <DT><A HREF="https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625">Windows Logon Failure Codes</A>
      <DT><A HREF="https://learn.microsoft.com/en-us/windows-server/identity/securing-privileged-access/reference-tools-logon-types">Windows Logon Types</A>
      <DT><A HREF="https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx?i=j">Windows Security Log Event IDs Encyclopedia</A>
      <DT><A HREF="https://help.zscaler.com/zia/nss-feed-output-format-dns-logs">ZScaler DNS Log Format</A>
      <DT><A HREF="https://help.zscaler.com/zia/nss-feed-output-format-firewall-logs">ZScaler Firewall Log Format</A>
      <DT><A HREF="https://help.zscaler.com/zia/about-url-categories">ZScaler URL Categories</A>
      <DT><A HREF="https://help.zscaler.com/zia/nss-feed-output-format-web-logs">ZScaler Web Log Format</A>
    </DL><p>
    <DT><H3>Resources</H3>
    <DL><p>
      <DT><A HREF="https://vincent03dinh.wordpress.com/2025/04/24/active-directory-detection-engineering-notes/">AD Detection Engineering Notes</A>
      <DT><A HREF="https://github.com/NikolasBielski/Adversarial-Detection-Engineering-Framework">Adversarial Detection Engineering Framework</A>
      <DT><A HREF="https://github.com/palantir/alerting-detection-strategy-framework#alerting-and-detection-strategies-framework">Alerting and Detection Strategies (ADS) Framework | Palantir</A>
      <DT><A HREF="https://x.com/cyb3rops/status/1592879894396293121">Detection Engineering Cheatsheet | Florian Roth</A>
      <DT><A HREF="https://ryanstillions.blogspot.com/2014/04/the-dml-model_21.html">Detection Engineering Maturity (DML) Model | Ryan Stillions</A>
      <DT><A HREF="https://detectionengineering.io/">Detection Engineering Maturity Matrix | Kyle Bailey</A>
      <DT><A HREF="https://www.ncsc.gov.uk/collection/building-a-security-operations-centre/detection/detection-practices">Detection Practices | ncsc</A>
      <DT><A HREF="https://detection.studio/">Detection Studio</A>
      <DT><A HREF="https://github.com/rabobank-cdc/DeTTECT/">DeTT&amp;CT</A>
      <DT><A HREF="https://github.com/tsale/EDR-Telemetry/tree/main">EDR Telemetry | tsale</A>
      <DT><A HREF="https://www.betaalvereniging.nl/wp-content/uploads/FI-ISAC-use-case-framework-verkorte-versie.pdf">MaGMa Use Case Framework</A>
      <DT><A HREF="https://center-for-threat-informed-defense.github.io/security-stack-mappings/Azure/README.html">Microsoft Azure Security Control Mappings to MITRE ATT&amp;CK</A>
      <DT><A HREF="https://attack.mitre.org/">MITRE ATT&amp;CK®</A>
      <DT><A HREF="https://d3fend.mitre.org/">MITRE D3fend</A>
      <DT><A HREF="https://mthcht.github.io/ThreatIntel-Reports/">Threat Intel Reports</A>
      <DT><A HREF="https://uncoder.io/">Uncoder IO</A>
      <DT><A HREF="https://github.com/strontic/xcyclopedia">xCyclopedia</A>
      <DT><A HREF="https://br0k3nlab.com/resources/zen-of-security-rules/">Zen of Security Rules | Justin Ibarra</A>
    </DL><p>
    <DT><H3>Labs</H3>
    <DL><p>
      <DT><A HREF="https://github.com/op7ic/BlueTeam.Lab">BlueTeam.Lab</A>
      <DT><A HREF="https://course.constructingdefense.com/constructing-defense">Constructing Defense</A>
      <DT><A HREF="https://github.com/clong/DetectionLab/">Detection LAB</A>
      <DT><A HREF="https://github.com/Krook9d/PurpleLab">PurpleLab</A>
      <DT><A HREF="https://github.com/splunk/attack_range">Splunk Attack Range</A>
    </DL><p>
    <DT><H3>Data Manipulation Online Tools</H3>
    <DL><p>
      <DT><A HREF="https://chatgpt.com/">ChatGPT</A>
      <DT><A HREF="https://csvjson.com/csv2json">CSVJSON</A>
      <DT><A HREF="https://gchq.github.io/CyberChef/">CyberChef</A>
      <DT><A HREF="https://www.diffchecker.com/">Diff Checker</A>
      <DT><A HREF="https://www.freeformatter.com/xml-formatter.html">Free Formatter</A>
      <DT><A HREF="https://grokdebugger.com/">Grok Debugger</A>
      <DT><A HREF="https://md5calc.com/hash">Hash Calculator</A>
      <DT><A HREF="https://jsonformatter.curiousconcept.com/#">JSON Formatter</A>
      <DT><A HREF="https://jsoncrack.com/editor">JSONCrack</A>
      <DT><A HREF="https://jsoning.com/">JSONing</A>
      <DT><A HREF="https://regex101.com/">Regex101</A>
      <DT><A HREF="https://regexr.com/">Regexr</A>
      <DT><A HREF="https://www.textfixer.com/">Text Fixer</A>
      <DT><A HREF="https://textmechanic.com/">Text Mechanic</A>
    </DL><p>
    <DT><H3>Blogs</H3>
    <DL><p>
      <DT><A HREF="https://ateixei.medium.com/">Alex Teixeira on Medium</A>
      <DT><A HREF="https://detect.fyi/">Detect.fyi</A>
      <DT><A HREF="https://www.detectionatscale.com/">Detection at Scale</A>
      <DT><A HREF="https://detections.xyz/">Detections.xyz</A>
      <DT><A HREF="https://www.elastic.co/security-labs">Elastic Security Labs Blog</A>
      <DT><A HREF="https://www.elastic.co/security-labs/topics/detection-engineering">Elastic Security Labs Blog Detection Engineering Category</A>
      <DT><A HREF="https://falconforce.nl/blogs/">FalconForce Blog</A>
      <DT><A HREF="https://redcanary.com/blog">Red Canary Blog</A>
      <DT><A HREF="https://redcanary.com/blog/?topic=threat-detection">Red Canary Blog Threat Detection Category</A>
      <DT><A HREF="https://www.elastic.co/security-labs/author/samir-bousseaden">Samir Bousseaden</A>
      <DT><A HREF="https://specterops.io/blog">SpecterOps Blog</A>
      <DT><A HREF="https://posts.specterops.io/on-detection/home">SpecterOps on Detection series | Jared Atkinson</A>
    </DL><p>
    <DT><H3>Newsletters</H3>
    <DL><p>
      <DT><A HREF="https://www.detectionengineering.net/">Detection Engineering Weekly</A>
    </DL><p>
    <DT><H3>Good Reads</H3>
    <DL><p>
      <DT><A HREF="https://cyb3rops.medium.com/about-detection-engineering-44d39e0755f0">About Detection Engineering | Florian Roth</A>
      <DT><A HREF="https://blog.palantir.com/alerting-and-detection-strategy-framework-52dc33722df2">Alerting and Detection Strategy Framework | Palantir</A>
      <DT><A HREF="https://blog.ecapuano.com/p/atomic-and-stateful-detection-rules">Atomic and Stateful Detection Rules</A>
      <DT><A HREF="https://www.tines.com/blog/automating-detection-as-code/">Automating Detection-as-Code | John Tuckner</A>
      <DT><A HREF="https://medium.com/anton-on-security/can-we-have-detection-as-code-96f869cfdc79">Can We Have “Detection as Code”? | Anton Chuvakin</A>
      <DT><A HREF="https://detect.fyi/can-we-stop-documenting-our-detections-ded2201ec09b">Can We Stop Documenting Our Detections?</A>
      <DT><A HREF="https://medium.com/@vanvleet/compound-probability-you-dont-need-100-coverage-to-win-a2e650da21a4">Compound Probability: You Don’t Need 100% Coverage to Win</A>
      <DT><A HREF="https://medium.com/falconforce/deploying-detections-at-scale-part-0x01-use-case-format-and-automated-validation-7bc76bea0f43">Deploying Detections at Scale — Part 0x01 use-case format and automated validation | Gijs Hollestelle</A>
      <DT><A HREF="https://purpleteamsec.substack.com/p/detection-as-code">Detection as Code | Panagiotis Gkatziroulis</A>
      <DT><A HREF="https://medium.com/snowflake/detection-development-lifecycle-af166fffb3bc">Detection Development Lifecycle | Haider Dost</A>
      <DT><A HREF="https://kyle-bailey.medium.com/detection-as-code-testing-c03b0eea7fb8">Detection-as-Code Testing</A>
      <DT><A HREF="https://blog.nviso.eu/2022/03/09/dettct-mapping-detection-to-mitre-attck/">DeTT&amp;CT : Mapping detection to MITRE ATT&amp;CK | Renaud Frère</A>
      <DT><A HREF="https://www.mbsecure.nl/blog/2019/5/dettact-mapping-your-blue-team-to-mitre-attack">DeTT&amp;CT: Mapping your Blue Team to MITRE ATT&amp;CK™</A>
      <DT><A HREF="https://slack.engineering/distributed-security-alerting/">Distributed Security Alerting</A>
      <DT><A HREF="https://www.elastic.co/security-labs/elastic-releases-debmm">Elastic releases the Detection Engineering Behavior Maturity Model</A>
      <DT><A HREF="https://medium.com/threatpunter/from-soup-to-nuts-building-a-detection-as-code-pipeline-28945015fc38">From soup to nuts: Building a Detection-as-Code pipeline</A>
      <DT><A HREF="https://medium.com/falconforce/how-data-science-can-boost-your-detection-engineering-maintenance-and-keep-you-from-herding-sheep-8713b7220776">How data science can boost your detection engineering maintenance and keep you from herding sheep | Agapios Tsolakis</A>
      <DT><A HREF="https://detect.fyi/how-to-prioritize-a-detection-backlog-84a16d4cc7ae">How to prioritize a Detection Backlog? | Alex Teixeira</A>
      <DT><A HREF="https://detect.fyi/introducing-the-drape-index-how-to-measure-in-success-in-a-threat-detection-practice-154fd977f731">Introducing the DRAPE Index: How to measure (in)success in a Threat Detection practice? | Alex Teixeira</A>
      <DT><A HREF="https://medium.com/starting-up-security/lessons-learned-in-detection-engineering-304aec709856">Lessons Learned in Detection Engineering | Ryan McGeehan</A>
      <DT><A HREF="https://detect.fyi/if-a-log-falls-in-the-siem-does-it-generate-an-alert-my-2025-detection-philosophy-5751c1a0ee56">My 2025 Detection Philosophy and the Pursuit of Immutable Artifacts | Koifsec</A>
      <DT><A HREF="https://medium.com/@rfackroyd/on-confidence-fd5dc954aa77">On Confidence | Richard Ackroyd</A>
      <DT><A HREF="https://posts.specterops.io/prioritization-of-the-detection-engineering-backlog-dcb18a896981">Prioritization of the Detection Engineering Backlog | Joshua Prager &amp; Emily Leidy</A>
      <DT><A HREF="https://medium.com/starting-up-security/prioritizing-detection-engineering-b60b46d55051">Prioritizing Detection Engineering | Ryan McGeehan</A>
      <DT><A HREF="https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html">Pyramid of Pain</A>
      <DT><A HREF="https://medium.com/@silaspotter17/rethinking-alert-severity-a-formula-for-consistent-scoring-abbcb60e42ac">Rethinking Alert Severity: A Formula for Consistent Scoring</A>
      <DT><A HREF="https://socinpurple.com/2023/07/08/soc-visibility-part-1/">SOC Visibility | walaakabbani</A>
      <DT><A HREF="https://medium.com/snowflake/threat-detection-maturity-framework-23bbb74db2bc">Threat Detection Maturity Framework | Haider Dost</A>
      <DT><A HREF="https://infosecwriteups.com/what-makes-a-good-detection-44417b6ef3de">What Makes a “Good” Detection? | The Cybersec Café</A>
      <DT><A HREF="https://socinpurple.com/2023/11/25/where-i-should-place-my-detections/">Where should I place my detections? | walaakabbani</A>
      <DT><A HREF="https://falconforce.nl/why-is-no-one-talking-about-maintenance-in-detection-engineering/">Why is no one talking about maintenance in detection engineering? | Agapios Tsolakis</A>
    </DL><p>
    <DT><H3>Books</H3>
    <DL><p>
      <DT><A HREF="https://www.packtpub.com/en-no/product/automating-security-detection-engineering-9781837636419">Automating Security Detection Engineering: A hands-on guide to implementing Detection as Code</A>
      <DT><A HREF="https://link.springer.com/book/10.1007/978-1-4842-6193-4">Malware Analysis and Detection Engineering: A Comprehensive Approach to Detect and Analyze Modern Malware</A>
      <DT><A HREF="https://www.packtpub.com/en-sg/product/practical-threat-detection-engineering-9781801076715">Practical Threat Detection Engineering: A hands-on guide to planning, developing, and validating detection capabilities</A>
    </DL><p>
    <DT><H3>Trainings</H3>
    <DL><p>
      <DT><A HREF="https://falconforce.nl/services/training/advanced-detection-engineering-training/">FalconForce Advanced Detection Engineering in the Enterprise training</A>
      <DT><A HREF="https://letsdefend.io/detection-engineering">LetsDefend Detection Engineering Path</A>
      <DT><A HREF="https://www.sans.org/cyber-security-courses/cybersecurity-engineering-advanced-threat-detection-monitoring/">SANS SEC511: Cybersecurity Engineering: Advanced Threat Detection and Monitoring</A>
      <DT><A HREF="https://www.sans.org/cyber-security-courses/detection-engineering-siem-analytics/">SANS SEC555: Detection Engineering and SIEM Analytics</A>
      <DT><A HREF="https://specterops.io/training/adversary-tactics-detection/">Specter Ops Adversary Tactics: Detection</A>
      <DT><A HREF="https://academy.tcm-sec.com/p/detection-engineering-for-beginners">TCM Security Detection Engineering for Beginners</A>
      <DT><A HREF="https://www.xintra.org/courses/1-attacking-and-defending-azure-m365">XINTRA Attacking and Defending Azure &amp; M365</A>
    </DL><p>
    <DT><H3>Podcasts</H3>
    <DL><p>
      <DT><A HREF="https://podcasts.apple.com/us/podcast/detection-at-scale/id1582584270">Detection at Scale</A>
      <DT><A HREF="https://creators.spotify.com/pod/show/dcppodcast">Detection Challenging Paradigms | SpecterOps</A>
    </DL><p>
    <DT><H3>Videos</H3>
    <DL><p>
      <DT><A HREF="https://www.youtube.com/@atomicsonafriday/streams">Atomics on a Friday</A>
      <DT><A HREF="https://www.youtube.com/watch?v=_JEvyem4ryg">Detection as Code: Detection Development Using CI/CD</A>
      <DT><A HREF="https://www.youtube.com/watch?v=VaZp7A6Q9zE">Detection-as-code: Why it works and where to start (Kyle Bailey)</A>
    </DL><p>
    <DT><H3>Conferences</H3>
    <DL><p>
      <DT><A HREF="https://deathcon.io/">DEATHcon</A>
    </DL><p>
    <DT><H3>Twitter/X</H3>
    <DL><p>
      <DT><A HREF="https://x.com/ateixei">@ateixei</A>
      <DT><A HREF="https://x.com/bohops">@bohops</A>
      <DT><A HREF="https://x.com/cyb3rops">@cyb3rops</A>
      <DT><A HREF="https://x.com/frack113">@frack113</A>
      <DT><A HREF="https://x.com/jaredcatkinson">@jaredcatkinson</A>
      <DT><A HREF="https://x.com/nas_bench">@nas_bench</A>
      <DT><A HREF="https://x.com/nextronresearch">@nextronresearch</A>
      <DT><A HREF="https://x.com/Oddvarmoe">@Oddvarmoe</A>
      <DT><A HREF="https://x.com/olafhartong">@olafhartong</A>
      <DT><A HREF="https://x.com/SBousseaden">@SBousseaden</A>
      <DT><A HREF="https://x.com/SecurityAura">@SecurityAura</A>
      <DT><A HREF="https://x.com/sigma_hq">@sigma_hq</A>
      <DT><A HREF="https://x.com/i/lists/952735755838738432">Awesome Detection List</A>
    </DL><p>
    <DT><H3>Other Resource Aggregator Projects</H3>
    <DL><p>
      <DT><A HREF="https://github.com/infosecB/awesome-detection-engineering">Awesome Detection Engineering | infosecB</A>
      <DT><A HREF="https://github.com/0x4D31/awesome-threat-detection">Awesome Threat Detection | 0x4D31</A>
      <DT><A HREF="https://github.com/rfackroyd/detection-engineering-starter-pack">Detection Engineering Starter Pack | rfackroyd</A>
    </DL><p>
  </DL><p>
</DL><p>