Small defensive artefacts from the writeups - rules, a KEV monitor, a blue-team reference. They are evidence of how the work is done, not a product line. Status labels are honest.
A zero-dependency Python monitor for the CISA Known Exploited Vulnerabilities (KEV) catalog. Tracks newly added, actively-exploited CVEs and flags ones that match products you care about. Public data only.
curl -sO https://umbrasec.dev/tools/kev-watch/kev_watch.py
The Sigma rules and KQL queries from the research writeups, shipped as runnable files - seven Sigma rules (Kerberoasting, LiteLLM command injection, N-central post-exploitation) and three OAuth consent-phishing KQL queries so far, each mapped to its ATT&CK technique. Grows one writeup at a time.
curl -sO https://umbrasec.dev/tools/sigma-pack/rules/windows/kerberoasting-spn-fanout.yml
A comprehensive, single-page defender reference - the full defensive lifecycle mapped end to end: SIEM and log-source priority, detection engineering, incident-response flow chains, threat hunting, identity and cloud hardening, SOAR playbooks, and LLM-app defense. ATT&CK-aligned, built for analysts who need actionable depth.
Open the mapper →Everything here lives in the public repository, issues and all. Found a bug, or want to suggest a tool? Open an issue →