#1IR playbooks, triage, case management, evidence collection, and incident management tools.
Kitploit recommended
kubeshark/kubesharkeBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via…
apache/calderaAutomated Adversary Emulation Platform
fleetdm/fleetOpen-source platform to secure and manage endpoints via MDM, patch management, software deployment, and osquery-powered visibility with compliance…
cowrie/cowrieCowrie SSH/Telnet Honeypot https://docs.cowrie.org/
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
swiftonsecurity/sysmon-configCommented Sysmon configuration template for high-quality Windows event tracing, threat hunting, and incident response. Designed as a tutorial for…
a-poc/blueteam-toolsTools and Techniques for Blue Team / Incident Response
netalertx/netalertxCentralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
security-onion-solutions/securityonionOpen-source security monitoring platform for threat hunting, intrusion detection, log management, incident response, and endpoint visibility with…
intelowlproject/intelowlScalable threat intelligence platform that enriches observables and files using 200+ analyzers, with built-in GUI, REST API, and automated workflows…
fabacab/awesome-cybersecurity-blueteam:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
ffffffff0x/1earnffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup
0x4d31/awesome-threat-detectionCurated list of threat detection and hunting resources: detection rules, SIEM and log analysis tools, endpoint/network monitoring, datasets,…
anthropic-experimental/sandbox-runtimeA lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.
mandiant/flare-flossFLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
pavel-odintsov/fastnetmonVery fast DDoS sensor with sFlow/Netflow/IPFIX/SPAN support
