#1Log parsing, SIEM, centralized logging, forensic timeline, and security event correlation tools.
Kitploit recommended
linux-audit/audit-kernelGitHub mirror of the Linux Kernel's audit repository
jepaynemsft/wefflesBuild a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI
elc0mpa/aws-doctorPowerful open-source CLI to audit security, costs, and best practices in AWS. 🩺 ☁️
corelight/zeek-cheatsheetsZeek Log Cheatsheets
owasp/securetea-projectThe OWASP SecureTea Project provides a one-stop security solution for various devices (personal computers / servers / IoT devices)
mgreen27/detectraptorA repository to share publicly available Velociraptor detection content
ctxis/snitchdnsDatabase Driven DNS Server with a Web UI
invictus-ir/alfaAutomated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…
hubblestack/hubbleHubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event…
canyonroad/agentshExecution-Layer Security (ELS) for AI agents — policy-enforced shell with audit.
hashicorp-forge/groveA Software as a Service (SaaS) log collection framework.
owasp/honeypot-projectDeploy web honeypots to capture emerging attack data, analyze ModSecurity audit logs via ELK, and share threat intelligence with MISP for…
randomuserid/adamaSearches For Threat Hunting and Security Analytics
logpai/deep-loglizerA deep learning toolkit for log-based anomaly detection
t4d/phishingkithunterFind phishing kits which use your brand/organization's files and image.
linnix-os/linnixeBPF-powered Linux observability with AI incident detection. AGPL-3.0 licensed.
the-dfir-report/sigma-rulesRules generated from our investigations.
anssi-fr/dfir-o365rcPowerShell module for Office 365 and Azure log collection
