Threat hunting involves identifying the presence of APT vectors in an enterprise organization. Given IOCs in the form of a query graph and a provenance graph, POIROT intends to perform efficient graph matching to identify APTs. This repository contains an implementation of POIROT.
The source code of POIROT and instructions to run it can be obtained by navigating to the poirot/ directory.
The datasets (provenance and query graph files) used for performing experiments in the final project report can be obtained by navigating to the datasets/ directory.