-
Notifications
You must be signed in to change notification settings - Fork 0
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
Add search histograms and field summary charts
area:dashboardDashboards and visual summariesDashboards and visual summariesarea:huntThreat hunt and search workflowsThreat hunt and search workflowsarea:searchQuery languages, pivots, and search UXQuery languages, pivots, and search UXpriority:mediumMedium priority implementation workMedium priority implementation workStatus: Open.#36 In jusso-dev/Tawny-SOC;Add scheduled analysis prompts
area:aiAI-assisted workflows and copilotsAI-assisted workflows and copilotsarea:alertsAlert queue, triage, grouping, and status workflowsAlert queue, triage, grouping, and status workflowsarea:operationsOperational reliability and SOC healthOperational reliability and SOC healthpriority:mediumMedium priority implementation workMedium priority implementation workStatus: Open.#35 In jusso-dev/Tawny-SOC;Add schema inference and parser test workbench
area:ingestionLog ingestion sources and transportsLog ingestion sources and transportsarea:normalizationParsing and canonical event normalizationParsing and canonical event normalizationarea:uiUser interface workUser interface workpriority:mediumMedium priority implementation workMedium priority implementation workStatus: Open.#34 In jusso-dev/Tawny-SOC;Add custom lookup enrichment tables
area:enrichmentContext enrichment and lookup dataContext enrichment and lookup dataarea:riskRisk scoring and risk contextRisk scoring and risk contextarea:threat-intelThreat intelligence indicators and feedsThreat intelligence indicators and feedspriority:mediumMedium priority implementation workMedium priority implementation workStatus: Open.#33 In jusso-dev/Tawny-SOC;Extract canonical indicator fields during ingestion
area:ingestionLog ingestion sources and transportsLog ingestion sources and transportsarea:normalizationParsing and canonical event normalizationParsing and canonical event normalizationarea:searchQuery languages, pivots, and search UXQuery languages, pivots, and search UXpriority:highHigh priority implementation workHigh priority implementation workStatus: Open.#32 In jusso-dev/Tawny-SOC;Expand correlation rules with sequence, group, and absence logic
area:correlationSignal and event correlationSignal and event correlationarea:detectionsDetection rules, packs, testing, and lifecycleDetection rules, packs, testing, and lifecyclearea:uebaBehavior and entity analyticsBehavior and entity analyticspriority:mediumMedium priority implementation workMedium priority implementation workStatus: Open.#31 In jusso-dev/Tawny-SOC;Add alert grouping, deduplication, and storm limiting
area:alertsAlert queue, triage, grouping, and status workflowsAlert queue, triage, grouping, and status workflowsarea:detectionsDetection rules, packs, testing, and lifecycleDetection rules, packs, testing, and lifecyclearea:operationsOperational reliability and SOC healthOperational reliability and SOC healthpriority:highHigh priority implementation workHigh priority implementation workStatus: Open.#30 In jusso-dev/Tawny-SOC;Formalize signals as first-class records separate from alerts
area:alertsAlert queue, triage, grouping, and status workflowsAlert queue, triage, grouping, and status workflowsarea:correlationSignal and event correlationSignal and event correlationarea:detectionsDetection rules, packs, testing, and lifecycleDetection rules, packs, testing, and lifecyclepriority:highHigh priority implementation workHigh priority implementation workStatus: Open.#29 In jusso-dev/Tawny-SOC;Add structured detection runbooks
area:aiAI-assisted workflows and copilotsAI-assisted workflows and copilotsarea:detectionsDetection rules, packs, testing, and lifecycleDetection rules, packs, testing, and lifecyclearea:playbooksPlaybooks, tasks, and response workflowsPlaybooks, tasks, and response workflowspriority:highHigh priority implementation workHigh priority implementation workStatus: Open.#28 In jusso-dev/Tawny-SOC;Draft detection rules from alerts or hunt results
area:aiAI-assisted workflows and copilotsAI-assisted workflows and copilotsarea:detectionsDetection rules, packs, testing, and lifecycleDetection rules, packs, testing, and lifecyclearea:huntThreat hunt and search workflowsThreat hunt and search workflowspriority:highHigh priority implementation workHigh priority implementation workStatus: Open.#27 In jusso-dev/Tawny-SOC;Summarize hunt results with cited records
area:aiAI-assisted workflows and copilotsAI-assisted workflows and copilotsarea:huntThreat hunt and search workflowsThreat hunt and search workflowsarea:investigationInvestigation artifacts and analyst workflowsInvestigation artifacts and analyst workflowspriority:mediumMedium priority implementation workMedium priority implementation workStatus: Open.#26 In jusso-dev/Tawny-SOC;Add natural-language query drafting for YAAQL
area:aiAI-assisted workflows and copilotsAI-assisted workflows and copilotsarea:huntThreat hunt and search workflowsThreat hunt and search workflowsarea:searchQuery languages, pivots, and search UXQuery languages, pivots, and search UXpriority:highHigh priority implementation workHigh priority implementation workStatus: Open.#25 In jusso-dev/Tawny-SOC;