Tools

renich/pared

Lightweight, secure control plane & real-time web dashboard in Crystal for Linux firewalld and NetworkManager host security.

dahnutz/zimbra-cve-2026-73570-ir

Detection-first incident-response toolkit for Zimbra administrators investigating CVE-2026-73570. Searches logs for exploit indicators, examines…

basitsajidsoc/soc-investigation-cve-2024-49138

Investigation and Incident Response report for LetsDefend Alert SOC335 (CVE-2024-49138 Exploitation)

betterdb-inc/monitor

Real-time monitoring and slowlog analysis for Valkey and Redis databases with anomaly detection, ACL auditing, and Prometheus metrics export.

diogo-fernan/ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

trustedsec/artillery

Open-source blue team tool that protects Linux and Windows systems using multiple host and network defense and detection methods.

orlikoski/skadi

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

yeet-src/sigwire

Live kernel signal observability tool using eBPF tracepoints to stream every signal raised on a Linux host, showing sender, target, disposition,…

karim852/kage-dfir-toolkit

Windows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…

g4bri-3l3/hostbadger

Windows host hardening auditor and remediation tool in PowerShell: CIS, DISA STIG, Essential Eight checks, reversible fixes, optional AI analysis

rorywag/hayabusa-bulk-runner

Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard

corelight/zeek-endpoint-enrichment

Zeek log enrichment tool that adds host information and known entity references to enhance network security monitoring and incident response.

karitamw/printnightmare-detection-mitigation-lab

Sanitised Windows security lab demonstrating Active Directory administration, host and network detection, and layered mitigation of CVE-2021-34527.

freeguy-6/dmz-security-monitoring-hardening

CY376 Blue Team project — pfSense DMZ, Suricata IDS/IPS, and automated host hardening against CVE-2014-6271

gary23w/hodometer

A single-file native Windows tray application (C, Win32, no runtime) that shows exactly which program is sending and receiving bytes and to which…

neo23x0/auditd

Best Practice Auditd Configuration

jaksi/sshesame

An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity