Thanks for your consideration to contribute the the Awesome Detection Engineering list! Please read through these guidelines if you'd like to submit a contribution.
Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms.
Ensure your pull request adheres to the following guidelines:
- Make sure your list item(s) follow the appropriate markdown format:
- [Short Title Here | Author/Org if applicable](URL here) - Brief description.
- In your pull request, please include a brief summary of why your contribution adds value to this list.
You may also submit an Issue if you'd like to quickly recommend a new resource.
This is a curated list, not a comprehensive one. To keep it useful, submissions must meet the following.
All submissions
- Directly relevant to detection engineering: rule authoring, testing, coverage, tuning, telemetry, detection-as-code, and so on. General-purpose security or "AI SOC" tools are out of scope unless they do something concrete for detections.
- Publicly accessible without a signup, waitlist, or paywall. Product landing pages and marketing content are not accepted.
- Disclose affiliation. If you wrote or maintain the resource, or work for the organization behind it, say so in the PR. Undisclosed self-promotion will be closed.
- One self-submitted entry per author or organization at a time.
Tools and code repositories must also be:
- At least 90 days old, with commits spread over that period rather than a single bulk upload.
- Used by people other than the author: roughly 25+ GitHub stars, issues or PRs from others, or independent write-ups or talks.
- Documented with a README that explains what it does, how to install and run it, and an example, and released under an open-source license.
- Actively maintained (commits in the last 12 months) and not archived.
An automated check comments on each PR showing how linked GitHub repositories measure up against these criteria. It is a guide; maintainers make the final call. Entries that stop meeting the criteria may be moved to the archive.
If your project doesn't qualify yet, you're welcome to resubmit once it does.
Thank you for your suggestions!
A lot of times, making a PR adhere to the standards above can be difficult. If the maintainers notice anything that we'd like changed, we'll ask you to edit your PR before we merge it. There's no need to open a new PR, just edit the existing one. If you're not sure how to do that, here is a guide on the different ways you can update your PR so that we can merge it.