Log Analysis

al0ne/nginx_log_check

Nginx日志安全分析脚本

r3nzsec/irflow-timeline

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

neo23x0/loki-rs

🐍 High-performance, multi-threaded YARA & IOC scanner

tsale/awesome-dfir-skills

A curated collection of DFIR skills and workflows for InfoSec practitioners.

darkquasar/azurehunter

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

d3vl/l3mon

Web-based network monitoring system providing real-time bandwidth tracking, server performance metrics, and customizable alerts for proactive network…

securityjoes/masterparser

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

justicerage/freedomfighting

A collection of scripts which may come in handy during your freedom fighting activities.

invictus-ir/alfa

Automated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…

nextronsystems/sysmon-config

Provides curated Sysmon event-tracing configuration templates for detecting Cobalt Strike, webshells, ransomware artifacts, and known exploit…

cisco-talos/deceive

DECeption with Evaluative Integrated Validation Engine (DECEIVE): Let an LLM do all the hard honeypot work!

owasp/python-honeypot

OWASP Honeypot, Automated Deception Framework.

aker-gateway/aker

SSH bastion/jump host/jumpserver

defenxor/dsiem

Security event correlation engine for ELK stack

kerlenton/mcpsnoop

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal.

jamf/aftermath

Swift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…