This folder contains vendor-organized network security content: hardening guidance, reference configurations, detection ideas, runbooks, validation steps, and audit-ready evidence material.
The purpose is practical reuse. A reader should be able to find a vendor, understand the control or workflow, apply it safely in a controlled environment, and capture proof that it worked.
Use content/ for public-safe material such as:
- Baseline hardening notes.
- Reference configurations with comments and assumptions.
- Validation commands and expected evidence.
- Detection and monitoring ideas.
- Operational runbooks, rollback notes, and break-glass guidance.
- Audit-ready evidence checklists.
- Vendor field guides and implementation notes.
Recommended layout:
content/
VendorName/
README.md
hardening/
detections/
runbooks/
evidence/
references.md
A vendor folder does not need every subfolder on day one. Add structure when there is actual content to place there.
Every vendor note should include:
- Product or platform scope.
- Version assumptions, if known.
- Required permissions.
- Exact setting, command, policy, query, or workflow.
- Validation method.
- Evidence to capture.
- Known risk, rollback, or operational impact.
- Public references when available.
Do not commit private customer configs, tokens, secrets, tenant URLs, internal IPs, private screenshots, or sensitive logs. Use sanitized examples and clearly mark placeholders.