#1IR playbooks, triage, case management, evidence collection, and incident management tools.
Kitploit recommended
microsoft/procdump-for-linuxA Linux version of the ProcDump Sysinternals tool
log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
jpcertcc/logontracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
sleuthkit/autopsyAutopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law…
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
yeti-platform/yetiYour Everyday Threat Intelligence
rabobank-cdc/dettectDetect Tactics, Techniques & Combat Threats
inverse-inc/packetfencePacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set including a…
jipegit/osxauditorOS X Auditor is a free Mac OS X computer forensics tool
mikeroyal/digital-forensics-guideDigital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.
kevthehermit/ratdecodersPython Decoders for Common Remote Access Trojans
bushidouk/ransomware-tool-matrixA resource containing all the tools each ransomware gangs uses
microsoft/msticpyMicrosoft Threat Intelligence Security Tools
beenuar/aisocOpen-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation.…
sans-blue-team/deepbluecliPowerShell-based threat hunting tool that analyzes Windows Event Logs to detect malicious activity including credential attacks, obfuscated commands,…
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
matthart1983/netwatchReal-time network diagnostics in your terminal. One command, zero config, instant visibility.
