SOC Prime

detectflow-main. Detection intelligence turbocharged with Al.

Uncoder_IO. An IDE and translation engine for detection engineers and threat hunters. Be faster, write smarter, keep 100% privacy.

SigmaUI. SIGMA UI is a free open-source application based on the Elastic stack and Sigma Converter (sigmac)

Roota. Roota is a public-domain language of threat detection and response that combines native queries from a SIEM, EDR, XDR, or Data Lake with standardized metadata and threat intelligence to enable automated translation into other languages

AIDR-Bastion. A comprehensive GenAI protection system designed to protect against malicious prompts, injection attacks, and harmful content. System incorporates multiple engines that operate in sequence to analyze and classify user inputs before they reach GenAI applications.

soc_workflow_app_ce. SOC Workflow App helps Security Analysts and Threat Hunters explore suspicious events, look into raw events arriving at the Elastic Stack, and view Saved Searches configured by teammates.

the-prime-hunt. A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation

SigmaRulesIntegration.

socprime_sigma. List of sigma for a variety of threats for multiple log sources.

detectflow-backend. Backend API for managing real-time pipelines with Sigma detection rules, built on Apache Flink and Kafka

detectflow-matchnode. Real-time threat detection using Apache Flink and Sigma rules

Sigma-Hunting-App. A Splunk App containing Sigma detection rules, which can be updated from a Git repository.

detectflow-ui. Web interface for administering DetectFlow pipelines

Azure-Sentinel. Cloud-native SIEM for intelligent security analytics for your entire enterprise.

sigma. Generic Signature Format for SIEM Systems

detectflow-parser. A DSL pipeline for parsing and transforming events using a flexible query-based syntax

detectflow-one-click-local-deployment. This repository provides a streamlined, "one-click" deployment path to set up the entire DetectFlow ecosystem locally using Docker and Kubernetes (Minikube)

sslframework. Python