Top incident-response open source projects

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

✭ 297

python python3 incident-response threat-hunting

Kuiper

Digital Forensics Investigation Platform

✭ 257

javascript security parser dfir incident-response digital-forensics

Threatpinchlookup

Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension

✭ 257

html security chrome-extension osint dfir incident-response threat-hunting cve shodan threatintel whois virustotal

InfosecHouse

Infosec resource center for offensive and defensive security operations.

✭ 61

tools incident-response hacking resources infosec offensive-security defensive-security pentest-tools

bits parser

Extract BITS jobs from QMGR queue and store them as CSV records

✭ 64

python windows incident-response forensics

SyntheticSun

SyntheticSun is a defense-in-depth security automation and monitoring framework which utilizes threat intelligence, machine learning, managed AWS security services and, serverless technologies to continuously prevent, detect and respond to threats.

rhq

Recon Hunt Queries

✭ 66

incident-response dfir threat-hunting osquery mitre-attack

aws-customer-playbook-framework

This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services.

✭ 43

aws incident-response playbooks

YAFRA

YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.

wazuh-puppet

Wazuh - Puppet module

fastfinder

Incident Response - Fast suspicious file finder

✭ 116

go YARA incident-response dfir threat-hunting investigation

CASE

Cyber-investigation Analysis Standard Expression (CASE) Ontology

✭ 46

Makefile python intelligence linked-data incident-response ontology json-ld observables standardization digital-forensics investigations criminal-justice case-ontology caseontology

ir scripts

incident response scripts

✭ 17

powershell windows incident-response forensics dfir sysmon threat-hunting

catalyst

Catalyst is an open source SOAR system that helps to automate alert handling and incident response processes

✭ 91

go typescript javascript Vue ANTLR shell incident-response dfir digital-forensics soar

incident-response-plan-template

A concise, directive, specific, flexible, and free incident response plan template

✭ 288

Makefile incident-response cybersecurity infosec information-security incident incident-management

compliance

Legal, procedural and policies document templates for operating an IRT

✭ 57

legal privacy incident-response gdpr csirt-activities privacy-notice

wazuh-cloudformation

Wazuh - Amazon AWS Cloudformation

✭ 32

shell security elasticsearch log-analysis monitoring incident-response ids pci-dss security-hardening vulnerability-detection ossec openscap wazuh policy-monitoring security-awareness file-integrity-monitoring

gsvsoc cirt-playbook-battle-cards

Cyber Incident Response Team Playbook Battle Cards

✭ 142

incident-response secops cybersecurity cyber-security-team cyber-threats playbook-battle-cards

awesome-incident-response-pro-bono

This repository is a curated list of pro bono incident response entities.

✭ 16

awesome incident-response awesome-list defender incident

GDPatrol

A Lambda-powered Security Orchestration framework for AWS GuardDuty

✭ 50

python aws cloud aws-lambda incident-response cybersecurity siem threatintel aws-security blueteam cloudsecurity soar aws-guardduty

training-materials

No description or website provided.

✭ 47

PHP elixir javascript CSS python java training incident-response malware cert csirt infosec misp thehive training-materials moloch investigation intelmq

Simple-Live-Data-Collection

Simple Live Data Collection Tool

✭ 22

python security incident-response

MemProcFS-Analyzer

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

✭ 89

incident-response dfir digital-forensics memory-forensics live-response memprocfs

Evilize

Parses Windows event logs files based on SANS Poster

✭ 24

powershell events incident-response dfir sans evt evtx eventlogs

PSTrace

Trace ScriptBlock execution for powershell v2

✭ 38

c C#CMake incident-response forensics dfir etw

LinuxCatScale

Incident Response collection and processing scripts with automated reporting scripts

✭ 143

shell linux collection incident-response triage countercept

Docker-Templates

Docker configurations for TheHive, Cortex and 3rd party tools

✭ 71

shell docker devops deployment incident-response dfir thehive cortex

uac

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

✭ 260

shell perl c Makefile android macos linux freebsd security terminal openbsd esxi incident-response forensics dfir netscaler netbsd solaris aix triage computer-forensics live-response

wazuh-ansible

Wazuh - Ansible playbook

CDIR

CDIR (Cyber Defense Institute Incident Response) Collector - live collection tool based on oss tool/library

✭ 122

c C++incident-response forensics dfir

wazuh-packages

Wazuh - Tools for packages creation

aws-security-hub-response-and-remediation

Pre-configured response & remediation playbooks for AWS Security Hub

✭ 58

aws-lambda incident-response aws-cloudformation aws-security cis-benchmark compliance-as-code cis-aws-benchmark aws-security-hub compliance-automation continuous-compliance

PowerGRR

PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.

✭ 52

powershell incident-response threat-hunting grr powershell-module

MindMaps

#ThreatHunting #DFIR #Malware #Detection Mind Maps

✭ 224

windows detection incident-response forensics dfir threat-hunting mindmap threat-intelligence

Azure-Sentinel-4-SecOps

Microsoft Sentinel SOC Operations

✭ 140

powershell HTML CSS M4 microsoft security azure incident-response secops threat-hunting siem hunting soc ir cloudsecurity threat-intelligence azure-sentinel microsoft-sentinel

INDXRipper

Carve file metadata from NTFS index ($I30) attributes

✭ 32

python incident-response forensics dfir ntfs digital-forensics mft indxparse

who and what to follow

Who and what to follow in the world of cyber security

✭ 124

security news network incident-response malware cybersecurity cyber-security

iris-web

Collaborative Incident Response platform

✭ 560

javascript python CSS HTML SCSS Dockerfile incident-response forensic csirt-tooling

MEAT

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

✭ 101

python ios incident-response forensics dfir ediscovery

ThePhish

ThePhish: an automated phishing email analysis tool

RdpCacheStitcher

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

✭ 176

C++QMake security incident-response forensics dfir cybersecurity rdp incident-response-tooling digitalforensics

macOS-ir

Prototype to collect data and analyse it from a compromised macOS device.

✭ 16

shell ruby macos incident-response

yara-exporter

Exporting MISP event attributes to yara rules usable with Thor apt scanner

✭ 22

python apt analysis scanner incident-response cert csirt thor misp yara

pyarascanner

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

✭ 23

python incident-response dfir yara yara-scanner

Packrat

Live system forensic collector

✭ 16

go Makefile incident-response forensics dfir forensics-investigations incident-response-tooling edr-toolsets

PowerSponse

PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.

✭ 35

powershell incident-response cleanup containment remediation

CCXDigger

The CyberCX Digger project is designed to help Australian organisations determine if they have been impacted by certain high profile cyber security incidents. Digger provides threat hunting functionality packaged in a simple-to-use tool, allowing users to detect certain attacker activities; all for free.

✭ 45

incident-response forensics dfir threat-intelligence digger velociraptor cybercx

assisted-log-enabler-for-aws

Assisted Log Enabler for AWS - Find AWS resources that are not logging, and turn them on.

✭ 167

python aws logging incident-response security-tools blue-team flow-logs

evtx-hunter

evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.

✭ 122

python CSS incident-response csirt infosec threat-hunting netsec evtx

Top 114 incident-response open source projects