884 Open source projects that are alternatives of or similar to Awesome Incident Response

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

Live system forensic collector

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

All-in-one bundle of MISP, TheHive and Cortex

A knowledge base of actionable Incident Response techniques

🔮 Visibility Across Space and Time

The CyberCX Digger project is designed to help Australian organisations determine if they have been impacted by certain high profile cyber security incidents. Digger provides threat hunting functionality packaged in a simple-to-use tool, allowing users to detect certain attacker activities; all for free.

Watcher - Open Source Cybersecurity Threat Hunting Platform. Developed with Django & React JS.

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Educational, CTF-styled labs for individuals interested in Memory Forensics

VirusTotal Wanna Be - Now with 100% more Hipster

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

Python script to decode common encoded PowerShell scripts

A portable OSINT Swiss Army Knife for DFIR/OSINT professionals 🕵️ 🕵️ 🕵️

A curated list of Site Reliability and Production Engineering resources.

Python API Client for TheHive

Carve file metadata from NTFS index ($I30) attributes

You didn't think I'd go and leave the blue team out, right?

CDIR (Cyber Defense Institute Incident Response) Collector - live collection tool based on oss tool/library

Trace ScriptBlock execution for powershell v2

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

Parses Windows event logs files based on SANS Poster

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

Cortex: a Powerful Observable Analysis and Active Response Engine

A list of cyber-chef recipes and curated links

Python API Client for Cortex

Explore Indicators of Compromise Automatically

Documentation of TheHive

PS / Bash / Python / Other scripts For FUN!

Invoke-LiveResponse

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

Imago is a python tool that extract digital evidences from images.

incident response scripts

Forensics artefact collection tool for systems running Microsoft Windows

Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

Cortex Analyzers Repository

DFIRTrack - The Incident Response Tracking Application

Incident Response - Fast suspicious file finder

YAFRA is a semi-automated framework for analyzing and representing reports about IT Security incidents.

OPCDE Cybersecurity Conference Materials

Who and what to follow in the world of cyber security

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

#ThreatHunting #DFIR #Malware #Detection Mind Maps

ThePhish: an automated phishing email analysis tool

Docker configurations for TheHive, Cortex and 3rd party tools

Provides various Windows Server Active Directory (AD) security-focused reports.

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Catalyst is an open source SOAR system that helps to automate alert handling and incident response processes

A concise, directive, specific, flexible, and free incident response plan template

Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension

Cyber Incident Response Team Playbook Battle Cards

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

A Lambda-powered Security Orchestration framework for AWS GuardDuty

Recon Hunt Queries

Digital Forensics Investigation Platform

Resources for learning about Text Mining and Natural Language Processing

A list of compilers that can generate C code