isherwood-sec/detection-engineering

GitHub: isherwood-sec/detection-engineering

该项目是一个安全检测规则管理框架，通过 TOML 格式和 CI/CD 流水线实现检测规则的自动化校验、MITRE 映射验证与 Elastic 平台同步。

Stars: 65 | Forks: 28

# detection-engineering [![Metrics](https://static.pigsec.cn/wp-content/uploads/repos/cas/11/1187aa08bab9be1c1bb6d8b6d6fad8f9eaaaa4b0e2ec2340a4af25d516769963.svg)](https://github.com/isherwood-sec/detection-engineering/actions/workflows/metrics.yml) [![更新检测规则](https://static.pigsec.cn/wp-content/uploads/repos/cas/38/38e6d9071dfa5b9c1f98f1aa29af2b14c168722847e89f0c0b393adc6627c68d.svg)](https://github.com/isherwood-sec/detection-engineering/actions/workflows/elastic_sync.yml) [![TOML/MITRE 验证](https://static.pigsec.cn/wp-content/uploads/repos/cas/2c/2cc36ac032cce1a6e6efc0947e2e2af09dbf2e5048a219ddd4a7a7f828919af1.svg)](https://github.com/isherwood-sec/detection-engineering/actions/workflows/toml_mitre_validation.yml)

标签：Cloudflare, Elasticsearch, MITRE ATT&CK, MIT许可证, Python安全, 安全工程, 开源框架, 持续集成, 检测规则, 网络调试, 网络资产发现, 自动化