Home/Products/Cybersecurity Tools/Detection & Threat Hunting

Detection & Threat Hunting

Splunk SPL, KQL, Elastic, and Sigma detection rules for threat hunting — 35 products

Language

EN FR ES

Frameworks

CCPA CIS CMMC DORA FedRAMP GDPR GLBA ISO-20000 ISO-22301 ISO-27001 ISO-9001 ITIL NIS2 NIST-800-171 NIST-800-53 NIST-CSF

NIST-CSFCISNIST-800-53+2

Sigma Rules — Full MITRE ATT&CK Coverage

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

Sigma Rules Pack — Cloud Attacks

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

Sigma Rules Pack — Web Application Attacks

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

Sigma Rules Pack — Linux Threats

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

Sigma Rules Pack — Windows Threats

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

Elastic — Threat Intelligence Integration Pack

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+3

Elastic — Cloud Monitoring Rules AWS GCP

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

Elastic — MITRE ATT&CK Rule Pack

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

Elastic — Endpoint Threat Detection Rules

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

Elastic — Active Directory Threat Detection

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

Elastic SIEM Detection Rules Pack

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+3

KQL — Network and Firewall Anomaly Detection

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

KQL — Windows Security Event Detection

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

KQL — Sentinel Workbook Templates

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

KQL — MITRE ATT&CK Coverage Pack

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

KQL — Cloud Resource Abuse Detection

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

KQL — Office 365 Threat Detection

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

KQL — Insider Threat Detection Pack

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

KQL — Ransomware Detection and Response

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

KQL — Microsoft Defender Threat Hunting

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

KQL — Azure AD Entra ID Attack Detection

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

KQL Detection Pack — Microsoft Sentinel

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Compliance Reporting Queries

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Web Application Attack Detection

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+3

Splunk SPL — Privileged Account Monitoring

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

Splunk SPL — MITRE ATT&CK Coverage Pack

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Phishing and Email Threat Queries

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Endpoint Detection Queries

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+3

Splunk SPL — Network Anomaly Detection

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Cloud Azure Threat Detection

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Cloud AWS Threat Detection

Deploy real detections in hours, not weeks. Battle-tested by a government CISO.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Insider Threat Detection Pack

Stop tuning default rules. Start deploying rules that were built for production.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Ransomware Detection Queries

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

Splunk SPL — Active Directory Attack Detection

Your SIEM needs better rules. Here are the ones that actually catch things.

NIST-CSFCISNIST-800-53+2

Splunk SPL Detection Pack — Threat Hunting

Your SIEM needs better rules. Here are the ones that actually catch things.

$149.00