#1Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
Kitploit recommended
hasecuritysolutions/vulnwhispererCreate actionable data from your Vulnerability Scans
mozilla/migDistributed & real time digital forensics at the speed of the cloud
snovvcrash/usbripTracking history of USB events on GNU/Linux
dropbox/securitybotDistributed alerting for the masses!
mandiant/silketwC# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…
grapl-security/graplGraph platform for Detection and Response
mandiant/mandiant-azure-ad-investigatorRead-only PowerShell module for detecting UNC2452 and other threat actor artifacts in Azure AD, auditing federated domains, service principals,…
blackhillsinfosec/eventloggingAutomation scripts to deploy Windows Event Forwarding, Sysmon, and custom audit policies in an Active Directory environment.
intezer/linux-explorerEasy-to-use live forensics toolbox for Linux endpoints
tnich/honsshHonSSH is designed to log all SSH communications between a client and server.
dfir-dd/dfir-toolkitCLI tools for forensic investigation of Windows artifacts
alb-uss/secmonSECMON is a web-based tool for the automation of infosec watching and vulnerability management with a web interface.
0x4d31/salt-scannerLinux vulnerability scanner based on Salt Open and Vulners audit API, with Slack notifications and JIRA integration
megamansec/ldap-monitoring-watchdogLDAP Watchdog: A real-time linux-compatible LDAP monitoring tool for detecting directory changes, providing visibility into additions, modifications,…
mitrecnd/whodatPivotable Reverse WhoIs / PDNS Fusion with Registrant Tracking & Alerting plus API for automated queries (JSON/CSV/TXT)
