Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

✭ 152

python dfir incident-response threat-hunting

Sleuthkit

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

✭ 1,948

c java C++M4 python perl forensics incident-response ntfs sleuthkit tct

Intelowl

Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale

Thehive4py

Python API Client for TheHive

✭ 143

python api open-source free api-client dfir incident-response free-software digital-forensics

Edr Testing Script

Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads

✭ 136

security security-audit incident-response

Mthc

All-in-one bundle of MISP, TheHive and Cortex

✭ 134

dfir incident-response threat-hunting threat-intelligence

Invoke Liveresponse

Invoke-LiveResponse

✭ 115

powershell dfir forensics incident-response

Information Security Tasks

This repository is created only for infosec professionals whom work day to day basis to equip ourself with uptodate skillset, We can daily contribute daily one hour for day to day tasks and work on problem statements daily, Please contribute by providing problem statements and solutions

✭ 108

html pentesting osint malware-analysis redteam forensics incident-response compliance information-security blueteam steganography auditing

Patrowldocs

PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform

✭ 105

html api automation security-tools ioc vulnerability-scanners security-scanner orchestration incident-response threat-hunting threat-intelligence security-automation vulnerability-detection vulnerability-management

Siac

SIAC is an enterprise SIEM built on open-source technology.

✭ 100

security aws incident-response elk compliance intrusion-detection siem osquery pci-dss

Threathunt

ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.

✭ 92

powershell dfir incident-response threat-hunting blueteam

Awesome

A curated list of awesome things related to TheHive & Cortex

✭ 88

awesome incident-response

Response

Monzo's real-time incident response and reporting tool ⚡️

✭ 1,252

javascript incident-response slack-bot response

Wazuh Documentation

Wazuh - Project documentation

✭ 82

javascript security monitoring documentation elasticsearch reference incident-response security-hardening vulnerability-detection compliance intrusion-detection log-analysis pci-dss

Yara Endpoint

Yara-Endpoint is a tool useful for incident response as well as anti-malware enpoint base on Yara signatures.

✭ 75

go incident-response yara

Ioc Explorer

Explore Indicators of Compromise Automatically

✭ 73

python security-tools cybersecurity incident-response threat-hunting threat-intelligence security-automation

Wheel Of Misfortune

A role-playing game for incident management training

✭ 57

html devops incident-response sre chaos-engineering

Scripting

PS / Bash / Python / Other scripts For FUN!

✭ 47

python powershell bash visualization detection exploit memory dfir incident-response binary-analysis malware-detection memory-hacking

Historicprocesstree

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

✭ 46

python dfir incident-response treeview

Ios Triage

incident response tool for iOS devices

✭ 42

javascript nodejs ios cli incident-response

Analyst Casefile

Maltego CaseFile entities for information security investigations, malware analysis and incident response

✭ 41

security malware-analysis incident-response malware-research

Beagle

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

✭ 976

python security graph dfir incident-response threat-hunting digital-forensics

Incident Response Docs

PagerDuty's Incident Response Documentation.

✭ 859

html documentation incident-response

Wazuh Chef

Wazuh - Chef cookbooks

✭ 9

ruby security monitoring elasticsearch chef incident-response security-hardening vulnerability-detection compliance intrusion-detection ids log-analysis pci-dss

Cortex4py

Python API Client for Cortex

✭ 22

python api open-source api-client dfir incident-response free-software

Awesome Sre

A curated list of Site Reliability and Production Engineering resources.

Bashfuscator

A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.

✭ 690

python bash linux infosec incident-response red-team obfuscation evasion

Velociraptor

Digging Deeper....

✭ 680

go incident-response digital-forensics inventory-management

My Arsenal Of Aws Security Tools

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

✭ 6,464

shell Makefile security cloud security-tools aws-lambda dfir incident-response iam auditing cloudtrail aws-infrastructure aws-inventory

Cortex

Cortex: a Powerful Observable Analysis and Active Response Engine

✭ 676

python scala api open-source rest free analysis engine analyzer dfir incident-response free-software observable response digital-forensics

Fame

FAME Automates Malware Evaluation

✭ 663

python framework malware infosec malware-analysis incident-response malware-research

Cyberchef Recipes

A list of cyber-chef recipes and curated links

✭ 619

malware regular-expression dfir incident-response

Osquery Configuration

A repository for using osquery for incident detection and response

✭ 618

detection incident-response information-security osquery

Intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

✭ 611

python automation malware cybersecurity ioc incident-response phishing intelligence alerts threat

Cyphon

Open source incident management and response platform.

✭ 543

python security-tools social-media incident-response alerting

Opcde

OPCDE Cybersecurity Conference Materials

✭ 538

cybersecurity vulnerability incident-response information-security

Howtheysre

A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)

Awesome Incident Response

A curated list of tools for incident response

✭ 4,753

security awesome awesome-list list cybersecurity dfir incident-response incident-response-tooling

Fcl

FCL (Fileless Command Lines) - Known command lines of fileless malicious executions

✭ 409

command-line malware malware-analysis incident-response threat-hunting malware-detection

Patrowlmanager

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform

✭ 363

html api automation security-tools ioc vulnerabilities vulnerability-scanners security-scanner orchestration incident-response threat-hunting threat-intelligence security-automation vulnerability-detection vulnerability-management scans

1-60 of 114 incident-response projects

›