Notebooks

This repository contains a collection of Jupyter Notebooks designed for SOC (Security Operations Center) analysts. These notebooks are tailored to assist in threat hunting and analysis using various SIEM (Security Information and Event Management) tools such as Microsoft Sentinel, Splunk, and others opensource Data Sources.

Overview

SOC analysts can leverage these notebooks to streamline their threat detection and response processes. Each notebook is crafted to address specific use cases and scenarios, providing a structured approach to analyzing security events and identifying potential threats.

Notebooks List

Below is the list of Jupyter Notebooks included in this repository, each aimed at enhancing your threat analysis capabilities:

1. Multi cloud Threat Hunting.ipynb

   • Description: This notebook provides techniques and queries to hunt for threats using Microsoft Sentinel from Multicloud envorinments.

2. IOC Analysis.ipynb

   • Description: Utilize this notebook to analyze IOC using Sentiel and hunt the suspicious activity.

Getting Started

To get started with these notebooks, follow the steps below:

1. Clone the repository:

   git clone https://github.com/your-repo/notebooks.git

2. Navigate to the repository directory: sh cd notebooks

3. Open the desired notebook using Jupyter: sh jupyter notebook

4. Select the notebook you want to work with from the Jupyter interface.

Prerequisites

• Ensure you have Jupyter Notebook installed. You can install it using pip: sh pip install notebook

• Ensure you have Installed MSTICPY from MSTICPY.