Tools

orlikoski/skadi

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

zeek/zeek

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

zolderio/token-proxy

A transparent PII redaction proxy for LLM API traffic. Sits between an application and an LLM provider (currently Anthropic), pseudonymizing…

owasp-modsecurity/modsecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based…

digitalruby/ipban

Automated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…

tsale/edr-telemetry

This project aims to compare and evaluate the telemetry of various EDR products.

tirrenotechnologies/tirreno

Open-source security framework for real-time event tracking, threat detection, and risk scoring. Monitors user behavior, detects fraud, bot attacks,…

hasecuritysolutions/vulnwhisperer

Create actionable data from your Vulnerability Scans

invictus-ir/microsoft-extractor-suite

A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.

darkquasar/azurehunter

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

lethal-forensics/memprocfs-analyzer

Automates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.

airbus-cert/winshark

A wireshark plugin to instrument ETW

cyberdefenders/detectionlabelk

DetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.

diogo-fernan/ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

mandiant/macos-unifiedlogs

Parses Apple Unified Logs to extract process, thread, activity, timestamp, and message metadata from logarchives or live macOS systems into JSONL/CSV…

pranshuchittora/simvyn

Universal mobile devtool for Agents & Humans - control iOS Simulators, Android Emulators, and real devices from a single dashboard and CLI

withsecurelabs/linuxcatscale

Incident Response collection and processing scripts with automated reporting scripts

acquiredsecurity/forensic-timeliner

A high-speed forensic timeline engine for Windows forensic artifact CSV output built for DFIR investigators. Quickly consolidate CSV output from…