Search apps by Tag¶

ADMON¶

• SA-admon

AWS¶

• SA-AwsAssets

Anomaly Detection¶

• Behavioral Profiling

Assets¶

• SA-admon
• SA-AwsAssets
• SA-AzureResources
• SA-CrowdstrikeDevices
• SA-EntraId
• SA-Rapid7Assets
• SA-SentinelOneDevices

Azure¶

• SA-AzureResources
• SA-EntraId

Best Practices¶

• ES Choreographer
• ES Config Explorer

Build Detections¶

• Anomaly Detection

CIM¶

• Data Model Mechanic

Conf Files¶

• Conf Manager

CrowdStrike¶

• SA-CrowdstrikeDevices
• SA-CrowdStrikeIdentites

Dashboards¶

• GV-Utils
• RBA GitHub

Data Quality Monitoring¶

• Broken Hosts
• TrackMe

Datamodels¶

• Data Model Mechanic

Discussions¶

• RBA GitHub

Entra ID¶

• SA-EntraId

Fraud¶

• Fraud Analytics

Health¶

• Broken Hosts
• Data Model Mechanic
• TrackMe

Identities¶

• SA-admon
• SA-CrowdStrikeIdentites

Implement¶

• Anomaly Detection
• Behavioral Profiling
• Detection Insights
• Fraud Analytics
• RBA Navigator
• Tuning Framework
• Zero-To-One

Learn¶

• threat_object_fun

Manage¶

• Conf Manager
• ES Choreographer
• ES Config Explorer
• Correlation Rules Runner

Metrics¶

• RBA Navigator

Misc¶

• Correlation Rules Runner
• GV-Utils
• RBA GitHub

Paid¶

• Zero-To-One

Partner-built¶

• Broken Hosts
• Data Model Mechanic
• Zero-To-One

Rapid7¶

• SA-Rapid7Assets

Script¶

• Correlation Rules Runner

Searches¶

• RBA GitHub

SentinelOne¶

• SA-SentinelOneDevices

Splunk Works¶

• Behavioral Profiling

Splunk-built¶

• Anomaly Detection
• Fraud Analytics

Supporting Add-on (SA)¶

• SA-admon
• SA-AwsAssets
• SA-AzureResources
• SA-CrowdstrikeDevices
• SA-CrowdStrikeIdentites
• SA-EntraId
• SA-Rapid7Assets
• SA-SentinelOneDevices
• Detection Insights

Threat Objects¶

• threat_object_fun

Tips¶

• RBA GitHub

Tuning¶

• RBA Navigator
• Tuning Framework
• Zero-To-One

Visualize¶

• Link Analysis