EDR & XDR Learning Tools
Practical, reference-grade tools covering every aspect of endpoint detection and response. Built for Indian SOC analysts working with any EDR platform.
Detection Engineering
EDR Use Case Library
Detection use cases for CrowdStrike, SentinelOne, and Microsoft Defender. MITRE mapped with FP guidance and tuning notes.
Browse use cases →MITRE to EDR Rule Mapper
Select any MITRE ATT&CK technique and see the exact rule, policy, or detection query for CrowdStrike, SentinelOne, and Defender.
Map techniques →Sysmon Config Generator
Generate a production-ready sysmonconfig.xml. Choose noise level, select event types, add environment exclusions, and download.
Generate config →Threat Hunting
Threat Hunt Hypothesis Generator
Select an APT group active in India and your EDR platform. Get 5 structured hypotheses with ready-to-run queries and expected findings.
Generate hunt plan →EDR Alert Triage Guide
Step-by-step triage playbooks for Malware, LSASS Access, PowerShell, Lateral Movement, Persistence, and Ransomware alerts.
View triage guide →EDR Maturity Assessment
Score your EDR programme across deployment, detection quality, response capability, and threat hunting maturity.
Assess maturity →Reference
Process Behaviour Encyclopedia
Normal vs suspicious behaviour for every critical Windows process. Expected parents, children, network behaviour, and red flags.
Browse processes →LOLBin Attack Technique Builder
Select any Windows LOLBin and see every malicious use case with exact command lines, MITRE mapping, and detection queries.
Browse LOLBins →Windows Event ID Reference
The 60 most important Windows Security Event IDs. Searchable with suspicious patterns, SOC notes, and MITRE mapping.
Search event IDs →Memory Forensics Reference
Volatility 2 and Volatility 3 commands side by side. Organised by investigation goal — find injected code, credentials, C2 connections.
View commands →EDR Evasion Reference
How attackers attempt to blind or bypass EDR. Unhooking, process hollowing, AMSI bypass, LOLBins — with residual detection signals.
View reference →Endpoint Hardening Checklist
Interactive Windows and Linux hardening checklist. CIS benchmark-based with actual commands. Track progress across your environment.
Start checklist →