Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
schira4396/vcenterkiller一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972/31656以及log4j，提供一键上传webshell，命令执行或者上传…
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
cyb3rfox/aurora-incident-responseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
neo23x0/raccineA Simple Ransomware Vaccine
logpresso/cve-2021-44228-scannerVulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
seccubus/seccubusEasy automated vulnerability scanning, reporting and analysis
activecm/ritaReal Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
cisagov/untitledgoosetoolUntitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to…
diogo-fernan/ir-rescueA Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
dougburks/so-cratesSO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
nccgroup/loggerplusplusAdvanced Burp Suite Logging Extension
securityclaw/securityclawA modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…
mandiant/macos-unifiedlogsParses Apple Unified Logs to extract process, thread, activity, timestamp, and message metadata from logarchives or live macOS systems into JSONL/CSV…
scarredmonk/sysmonsimulatorSysmon event simulation utility which can be used to simulate the attacks to generate the Sysmon Event logs for testing the EDR detections and…
fenkohq/dnsmonsterPassive DNS Capture and Monitoring Toolkit
tugcantopaloglu/openclaw-dashboard🔐 Secure, real-time monitoring dashboard for OpenClaw AI agents. Auth, TOTP MFA, cost tracking, live feed, memory browser and more.
