beagle
yampelo/beagleBeagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
digital-forensicsforensicsincident-response+2
1.4k6 years ago
yampelo/beagleBeagle is an incident response and digital forensics tool which transforms security logs and data into graphs.
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
withsecurelabs/flairLightweight batch script for semi-automated acquisition of key forensic artefacts from Windows hosts, using only native OS tools to support incident…
osquery/osquerySQL powered operating system instrumentation, monitoring, and analytics.
arkime/arkimeArkime is an open source, large scale, full packet capturing, indexing, and database system.
withsecureopensource/chainsawRapidly Search and Hunt through Windows Forensic Artefacts
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
usarmyresearchlab/dshellDshell is a network forensic analysis framework.
abrignoni/ileappParses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…
ahmedkhlief/apt-hunterAPT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of…
omerbenamram/evtxA Fast (and safe) parser for the Windows XML Event Log (EVTX) format
wagga40/zircoliteA standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
cyb3rfox/aurora-incident-responseIncident Response Documentation made easy. Developed by Incident Responders for Incident Responders
mandiant/macos-unifiedlogsA cross platform parser for Apple UnifiedLogs!
jamf/aftermathSwift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…