131 Open source projects that are alternatives of or similar to TheHiveHooks

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

Docker configurations for TheHive, Cortex and 3rd party tools

A repository of sysmon configuration modules

Your Everyday Threat Intelligence

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

A curated list of awesome forensic analysis tools and resources

Open Source EDR for Windows

Smart OSINT collection of common IOC types

A knowledge base of actionable Incident Response techniques

📇 Digital Forensics Artifact Repository (forensicanalysis edition)

Investigate malicious Windows logon by visualizing and analyzing Windows event log

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Python script to decode common encoded PowerShell scripts

VirusTotal Wanna Be - Now with 100% more Hipster

🔮 Visibility Across Space and Time

Yara Ruleset for scanning Linux servers for shells, spamming, phishing and other webserver baddies

Imago is a python tool that extract digital evidences from images.

PS / Bash / Python / Other scripts For FUN!

Timeline of Active Directory changes with replication metadata

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

A Splunk app mapped to MITRE ATT&CK to guide your threat hunts

Test Blue Team detections without running any attack.

A list of cyber-chef recipes and curated links

Collaborative forensic timeline analysis

Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

Invoke-LiveResponse

A portable OSINT Swiss Army Knife for DFIR/OSINT professionals 🕵️ 🕵️ 🕵️

A port of Kaitai to the Hiew hex editor

DFIRTrack - The Incident Response Tracking Application

ThreatHunt is a PowerShell repository that allows you to train your threat hunting skills.

Everything related to Linux Forensics

Windows Events Attack Samples

The CyberCX Digger project is designed to help Australian organisations determine if they have been impacted by certain high profile cyber security incidents. Digger provides threat hunting functionality packaged in a simple-to-use tool, allowing users to detect certain attacker activities; all for free.

Signature base for my scanner tools

Warning lists to inform users of MISP about potential false-positives or other information in indicators

Event Trace Log file parser in pure Python

A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.

Automagically extract forensic timeline from volatile memory dump

Zombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.

Live system forensic collector

Malcom - Malware Communications Analyzer

Loki - Simple IOC and Incident Response Scanner

CIRCL system forensic tools or a jumble of tools to support forensic

Query and report user logons relations from MS Windows Security Events

Python API Client for Cortex

Python API Client for TheHive

Educational, CTF-styled labs for individuals interested in Memory Forensics

Automate the creation of a lab environment complete with security tooling and logging best practices

Cortex: a Powerful Observable Analysis and Active Response Engine

All-in-one bundle of MISP, TheHive and Cortex

Web browser forensics for Google Chrome/Chromium

Misc Threat Hunting Resources

Automation and Scaling of Digital Forensics Tools

Tools for the Computer Incident Response Team 💻

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.

Cortex Analyzers Repository

Forensics artefact collection tool for systems running Microsoft Windows