Incident Response
218 items from meirwah/awesome-incident-response ★9,444
-
Network Flight Simulator github.com
Lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.
-
-
-
-
-
ThreatHunter-Playbook github.com
Playbook to aid the development of techniques and hypothesis for hunting campaigns.
-
-
DumpsterFire github.com
Modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale…
-
https://github.com/ufrisk/MemProcFS github.com
) - MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.
-
-
Cynative github.com
Framework for building security engineering AI agents in Go. Read-only by construction, built-in sandbox, 45 agent blueprints for AWS, GCP, Azure, K8s, GitHub & GitLab deep research.
-
-
Chainsaw github.com
Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows event logs.
-
-
Hayabusa github.com
Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool created by the Yamato Security group in Japan.
-
StringSifter github.com
A machine learning tool that ranks strings based on their relevance for malware analysis.
-
-
Security Onion github.com
Special Linux distro aimed at network security monitoring featuring advanced analysis tools.
-
-
StreamAlert github.com
Serverless, real-time log data analysis framework, capable of ingesting custom data sources and triggering alerts using user-defined logic.
-
CimSweep github.com
Suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
-
-
-
-
-
PSRecon github.com
PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over…
-
Meerkat github.com
PowerShell-based Windows artifact collection for threat hunting and incident response.
-
threat_note github.com
Lightweight investigation notebook that allows security researchers the ability to register and retrieve indicators related to their research.
-
-
IRIS github.com
IRIS is a web collaborative platform for incident response analysts allowing to share investigations at a technical level.
-
-
UAC github.com
UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
-
-
-
Dissect github.com
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
-
-
-
-
Red Team Automation (RTA) github.com
RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.
-
-
macOS Artifact Parsing Tool (mac_apt) github.com
Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files.
-
Aurora Incident Response github.com
Platform developed to build easily a detailed timeline of an incident.
-
Margarita Shotgun github.com
Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition.
-
-
rastrea2r github.com
Allows one to scan disks and memory for IOCs using YARA on Windows, Linux and OS X.
-
-
-
-
Zentral github.com
Combines osquery's powerful endpoint inventory features with a flexible notification and action framework. This enables one to identify and react to changes on OS X and Linux clients.
-
- next page of items loading…
