#1IR playbooks, triage, case management, evidence collection, and incident management tools.
Kitploit recommended
corelight/ecs-logstash-mappingsMapping Corelight or Zeek data to Elastic Common Schema logs
grafana/lokiHorizontally scalable, multi-tenant log aggregation system that indexes labels instead of full text, integrates with Grafana, and is optimized for…
pnwcomputers/ultimate-cybersecurity-master-guideThis repository provides a centralized resource for operational cyber defense and offense, compiling Theory, Tools, Operating Procedures, and…
abrignoni/ileappParses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…
yeti-platform/yetiYour Everyday Threat Intelligence
inverse-inc/packetfencePacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…
microsoft/avmlPortable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…
tenzir/tenzirCollect, parse, normalize, aggregate, store, query, and route security telemetry data at scale using pipeline-based dataflows for threat detection…
perplexityai/bumblebeeRead-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software…
wslyvh/paperweightPaperweight scans your inbox to map your digital footprint, then helps you take back control and delete your data. Local-first and open source.
cynative/cynativeRead-only AI agent that queries your cloud, code, and runtime infrastructure to surface misconfigurations, leaked secrets, and privilege escalation…
dfir-iris/iris-webCollaborative Incident Response platform
kontext-security/kontext-cliSecure agents in seconds with permissions enforced at runtime.
cyb3rxp/awesome-socA curated knowledge base to build, run and mature a SOC (including CSIRT).
kunai-project/kunaieBPF-based Linux security monitor and threat hunter providing chronologically ordered, container-aware events with on-host correlation for incident…
stanfrbd/cyberbroA simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
rankthree/soc-detection-t1003.001-cve-2021-40444SOC detection rules and content for T1003.001 LSASS credential dumping and CVE-2021-40444 exploitation activity.
cloud-gouv/securixSécurixOS is a NixOS-based secure operating system tailored for small to medium-sized teams. It provides a minimal, hardened environment with strong…
