|<@rm!n3

DEF3ND. 🛡️ SIGMA Detection Engineering Platform A comprehensive AI-powered detection engineering platform for security teams to explore MITRE ATT&CK, build SIGMA rules, and visualize attack paths.

fleet-hound. High-performance graph visualization tool for FleetDM

agentic-detector. Cross-platform osquery extension: one agentic_software table detecting MCP servers, AI agent CLIs, AI apps, IDE plugins, and live AI/MCP network sockets. Detection-only, Fleet-deployable.

Threat-Hunting. Learn how to threat hunt leveraging Jupiter NoteBook and Apache Spark.

fleet-mcp. 🚀 An Model Context Protocol (MCP) server for Fleet. Query OSQuery data, check compliance, and investigate CVEs natively from Claude, Cursor, and any MCP-compatible AI agent.

CTI_LocalLLM_WebScrapping. Leveraging LocalLLMs and WebScrapping using langchain to create a CTI engine to provide & enrich context over time. Currently the WebScrapper is only able to collect reports from DFIR_Reports.

agenticRAG. A framework to leverage agenticRAG systems. This particular project focuses on CTI

fleet_policies. This repository provides security policies for macOS based on the Center for Internet Security (CIS) v8.1 Benchmark. It contains YAML policy files for Fleet. These files define security controls with corresponding SQL queries for compliance checking and enforcement. The repository also includes mappings to compliance frameworks like SOC 2.

threathunting-aiagents. Production-ready osquery threat hunting hunts and Fleet query packs designed to detect, inventory, and audit autonomous AI agents, coding assistants (Claude Code, Cursor, Windsurf, Openclaw, etc), and modular agentic frameworks.

OPENCTI. This is docker-compose to deploy openCTI for a swarm set up.

fleet-cis-dashboard. A containerized dashboard for Fleet that turns CIS 8.1 compliance data into a living view of your security posture. It connects standard audits with MITRE ATT&CK and D3FEND to show exactly what's failing and how to defend against it.