What is Detection and Response Pipeline
Incident response and digital forensics tool for transforming data sources and logs into graphs.
A compilation of recommended tools for detection and response pipelines
This document provides a compilation of recommended tools for each component within a detection and response pipeline, accompanied by real-world examples to illustrate their application.
The Purpose is to Create a Comprehensive Reference Hub for Threat Detection and Response
The purpose is to create a reference hub for designing effective threat detection and response pipelines. We invite you to join us, explore the carefully curated content, and contribute to this collaborative effort. Main Components of a Detection & Response Pipeline: - Detection-as-Code Pipeline - Data Pipeline - Detection and Correlation Engine - Response Orchestration and Automation - Investigation and Case Management - Real-world Examples - Additional Resources Detection-as-Code Pipeline Tool / Service Purpose: - GitHub: For developing detection content - GitLab: For developing detection content - Gitea: For developing detection content - AWS CodeCommit: For developing detection content - GitHub Actions: For CI/CD pipeline - GitLab Runner: For CI/CD pipeline - Drone: For CI/CD pipeline - AWS CodePipeline: For CI/CD pipeline Resources: Automating Detection-as-Code: This example reference utilizes GitHub for detection content development, GitHub Actions for CI/CD, Elastic as the SIEM, GitHub Issues for alert management, and Tines for handling alerts and responses. Practical Detection-as-Code: An example that demonstrates the application of these concepts.
Detection and Response Pipeline Reviews
No reviews yet.
