#1IR playbooks, triage, case management, evidence collection, and incident management tools.
Kitploit recommended
sleuthkit/sleuthkitForensic library and CLI toolkit for analyzing disk and file system images, recovering deleted data, generating timelines, and validating evidence…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
0x90n/infosec-black-fridayAll the deals for InfoSec related software/tools this Black Friday
sepinf-inc/ipedIPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…
thinkst/canarytokensCanarytokens helps track activity and actions on your network
olafhartong/sysmon-modularA repository of sysmon configuration modules
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
cyb3rxp/awesome-socA curated knowledge base to build, run and mature a SOC (including CSIRT).
freedomofpress/dangerzoneTake potentially dangerous PDFs, office documents, or images and convert them to safe PDFs
withsecureopensource/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
thinkst/opencanaryLow-resource honeypot that emulates common network services to detect post-breach attacker activity, with extensible protocol modules and…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
shuffle/shuffleOpen-source security orchestration, automation, and response (SOAR) platform with a visual workflow editor, prebuilt security app integrations, and…
purp1ew0lf/blue-team-notesYou didn't think I'd go and leave the blue team out, right?
opencve/opencveAggregate, filter, and track CVEs from multiple sources with team collaboration, custom dashboards, alerts, and AI-powered analysis for vulnerability…
microsoft/procdump-for-linuxA Linux version of the ProcDump Sysinternals tool
