Threat-led detection library for SOC teams: 2,000+ use cases mapped to MITRE ATT&CK, with Defender KQL, Sentinel KQL, Sigma, and Splunk SPL queries. Built from 11+ threat-intel feeds (BleepingComputer, The Hacker News, Microsoft, Talos, ESET, Unit 42, SentinelLabs, Securelist, Lab52, CISA KEV) and refreshed every 2 hours.