systeminformer
winsiderss/systeminformerReal-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…
debuggersdigital-forensicsforensics+6
16.2k
winsiderss/systeminformerReal-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
sekoialab/fastir_collectorLive Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…
xe1phix/parrotlinux-public-kiosk-projectSystematic Linux kernel hardening project implementing KSPP-recommended settings, module blacklisting, and restricted environment configuration for…
theevidencehunter/forensixDigital Forensics Intelligence Framework
ndaal_open_source/ndaal_public_auditdBest-practice Linux Auditd rule set with 14,956 MITRE ATT&CK-mapped rules, Ansible deployment role, and lint/test tooling for security monitoring and…
clong/detectionlabAutomate the creation of a lab environment complete with security tooling and logging best practices
jipegit/osxauditorOS X Auditor is a free Mac OS X computer forensics tool
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.
yamato-security/enablewindowslogsettingsDocumentation and scripts to properly enable Windows event logs.
r3nzsec/irflow-timelineDFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
diogo-fernan/ir-rescueA Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
biggiesmallsag/nighthawkresponseIncident Response Forensic Framework
chainguard-dev/osquery-defense-kitProduction-ready detection & response queries for osquery
korben00/no-gdidRead, understand and silence the Windows GDID device identifier (the ID that tracked a hacker through a VPN). Verified on a real Win11 VM. Honest: it…
dwmetz/cyberpipeAn easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.