This repository is a community-driven threat hunting and detection engineering knowledge base rather than a deployable application. It contains 26+ Windows-focused Jupyter notebooks (authored as Jupytext Markdown) that each follow a strict hypothesis-driven methodology: hypothesis, technical context, offensive tradecraft, pre-recorded security datasets, SQL/Pandas analytics, and Sigma rule output. The repo also includes deep Windows internals documentation, MITRE ATT&CK group profiles (CTI), pre-hunt data management guidance, and a small YARA signature set. The dominant character is data_research: the core artifacts are analytical notebooks, structured metadata, and threat intelligence data, with a hybrid component of Python build scripts that generate the Jupyter Book, table of contents, ATT&CK Navigator layers, and evaluation reports.
BeaKer is a self-contained threat-hunting deployment for Windows network beacon detection. It provisions an Elasticsearch/Kibana backend with Docker Compose, configures Windows endpoints via a PowerShell agent installer, and ships prebuilt index templates, ingest pipelines, and Kibana dashboards for Sysmon event data. The dominant character is an application/infrastructure project: the core artifacts are deployment scripts, Ansible playbooks, and ELK configuration rather than a library or data analysis framework. A secondary data-pipeline nature is visible in the Elasticsearch ingest pipelines that normalize Windows Security/PowerShell/Sysmon events into ECS, and in the export/import tooling for dashboards and indices.