ThreatHound
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
digital-forensicsincident-responselog-analysis+1
159
mazx0p/threathoundAutomated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
jpcertcc/logontracerInvestigate malicious Windows logon by visualizing and analyzing Windows event log
devinblack001/ddos-reduction-systemAdaptive two-stage Layer 4 DDoS mitigation gateway using behavioral traffic analysis, Random Forest classification, and kernel-level ipset/iptables…
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
withsecureopensource/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
telekom-security/tpotce🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
big-comfy/deadairFinds the detection rules in your SIEM that are running blind
cyb3rfox/aurora-incident-responseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders
meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
digitalruby/ipbanAutomated IP ban service that detects failed login attempts from event logs and files, blocking attackers on Windows and Linux via firewall…
ekitji/siemCurated SIEM queries and techniques for offensive discovery of Windows privilege escalation, misconfigured ACLs, services, scheduled tasks, and…
abrignoni/aleappAndroid Logs Events And Protobuf Parser
betterdb-inc/monitorReal-time monitoring and slowlog analysis for Valkey and Redis databases with anomaly detection, ACL auditing, and Prometheus metrics export.
umidguluzada/cyberdefense-labA complete Blue Team Cybersecurity Lab featuring pfSense, Suricata, and ELK Stack for network monitoring and threat detection.
cyberdefenders/detectionlabelkDetectionLabELK is a fork from DetectionLab with ELK stack instead of Splunk.