sans-blue-team/deepbluecliPowerShell-based threat hunting tool that analyzes Windows Event Logs to detect malicious activity including credential attacks, obfuscated commands,…
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
outflanknl/redelkRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
t0pcyber/hawkPowershell Based tool for gathering information related to O365 intrusions and potential Breaches
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
ahmedkhlief/apt-hunterAPT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…
mrwadams/attackgenAttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK…
nowsecure/fsmonFilesystem monitor tool for Linux/Android iOS/macOS
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
misp/misp-taxonomiesTaxonomies used in MISP taxonomy system and can be used by other information sharing tool.
velocidex/winpmemThe multi-platform memory acquisition tool.
trycatchhcf/dumpsterfire"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events.…
dfir-orc/dfir-orcForensics artefact collection tool for systems running Microsoft Windows
yampelo/beagleBeagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
prismorsec/prismorSelf-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt…
securityjoes/masterparserMasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
invictus-ir/alfaAutomated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…
sekoialab/fastir_collectorLive Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…
