
osquery
SQL powered operating system instrumentation, monitoring, and analytics.

SQL powered operating system instrumentation, monitoring, and analytics.

Offline-first network investigation and response platform for Windows. Turns a pcap or live capture into a full forensic verdict — attack story,…

HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be…

A modular, skill-based autonomous Security Operations Center (SOC) agent that monitors OpenSearch/Elasticsearch data, builds RAG-based behavioral…

Analysis and Representation of Graphs of Suspicious Operations (Analyse et Représentation des Graphes des Opérations Suspectes)

A network packet forensics tool for SSH

Programmable packet inspection engine with NIDS, DNS classification, frequency analysis, and auto-regex generation. Supports Python/Ruby/Java/Lua…

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

ML-assisted forensic analysis tool that automates memory, disk, and live system triage on Windows using Volatility 3, autorunsc, and sigcheck to…

Forensic intelligence platform that analyzes files, correlates threat indicators, maps behavior to MITRE ATT&CK, and generates actionable security…

Flows-first PCAP TUI (case files, gorgeous UX). Do do do do.

Fingerprint SSH clients and servers.


Basic log analysis tool to detect impossible travel via IP address geographic information

Enumerate various traits from Windows processes as an aid to threat hunting

Unix endpoint detection and response solution using kernel-level mechanisms to detect anomalies and malware attacks in real time.

PETriage: A symbol-unified PE file reader for triage, built for multi-platform and multi-interface use.