Incident Response
218 items from meirwah/awesome-incident-response ★9,444
-
Falcon Orchestrator github.com
Extendable Windows-based application that provides workflow automation, case management and security response functionality.
-
Counteractive Playbooks github.com
Counteractive PLaybooks collection.
-
AWS Incident Response Runbook Samples github.com
AWS IR Runbook Samples meant to be customized per each entity using them. The three samples are: "DoS or DDoS attack", "credential leakage", and "unintended access to an Amazon S3 bucket".
-
sqhunter github.com
Threat hunter based on osquery and Salt Open (SaltStack) that can issue ad-hoc or distributed queries without the need for osquery's tls plugin. sqhunter allows you to query open network sockets and check them against threat intelligence sources.
-
The Appliance for Digital Investigation and Analysis (ADIA) forensics.cert.org
VMware-based appliance used for digital investigation and acquisition and is built entirely from public domain software. Among the tools contained in ADIA are Autopsy, the Sleuth Kit, the Digital Forensics Framework, log2timeline, Xplico, and Wireshark. Most of the system…
-
GetData Forensic Imager forensicimager.com
Windows based program that will acquire, convert, or verify a forensic image in one of the following common forensic file formats.
-
Memoryze fireeye.com
Free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the paging file in its analysis.
-
IOC Finder fireeye.com
Free tool from Mandiant for collecting host system data and reporting the presence of Indicators of Compromise (IOCs). Support for Windows only. No longer maintained. Only fully supported up to Windows 7 / Windows Server 2008 R2.
-
Highlighter fireeye.com
Free Tool available from Fire/Mandiant that will depict log/text file that can highlight areas on the graphic, that corresponded to a key word or phrase. Good for time lining an infection and what was done post compromise.
-
Event Log Explorer eventlogxp.com
Tool developed to quickly analyze log files and other data.
-
Eric Zimmerman Tools ericzimmerman.github.io
An updated list of forensic tools created by Eric Zimmerman, an instructor for SANS institute.
-
Microsoft ProcDump docs.microsoft.com
Dumps any running Win32 processes memory image on the fly.
-
Digital Forensics Discord Server discordapp.com
Community of 8,000+ working professionals from Law Enforcement, Private Sector, and Forensic Vendors. Additionally, plenty of students and hobbyists! Guide here.
-
SANS Investigative Forensic Toolkit (SIFT) Workstation digital-forensics.sans.org
Demonstrates that advanced incident response capabilities and deep dive digital forensic techniques to intrusions can be accomplished using cutting-edge open-source tools that are freely available and frequently updated.
-
Slack DFIR channel dfircommunity.slack.com
Slack DFIR Communitiy channel - Signup here.
-
DFIR ORC dfir-orc.github.io
DFIR ORC is a collection of specialized tools dedicated to reliably parse and collect critical artifacts such as the MFT, registry hives or event logs. DFIR ORC collects data, but does not analyze it: it is not meant to triage machines. It provides a forensically relevant…
-
Cyber Triage cybertriage.com
Cyber Triage collects and analyzes host data to determine if it is compromised. It's scoring system and recommendation engine allow you to quickly focus on the important artifacts. It can import data from its collection tool, disk images, and other collectors (such as KAPE). It…
-
CyberCPR cybercpr.com
Community and commercial incident management tool with Need-to-Know built in to support GDPR compliance while handling sensitive incidents.
-
Crowd Response crowdstrike.com
Lightweight Windows console application designed to aid in the gathering of system information for incident response and security engagements. It features numerous modules and output formats.
-
Computer Aided Investigative Environment (CAINE) caine-live.net
Contains numerous tools that help investigators during their analysis, including forensic evidence collection.
-
Live Response Collection brimorlabs.com
Automated tool that collects volatile data from Windows, OSX, and *nix based operating systems.
-
IREC binalyze.com
All-in-one IR Evidence Collector which captures RAM Image, $MFT, EventLogs, WMI Scripts, Registry Hives, System Restore Points and much more. It is FREE, lightning fast and easy to use.
-
RTIR bestpractical.com
Request Tracker for Incident Response (RTIR) is the premier open source incident handling system targeted for computer security teams. We worked with over a dozen CERT and CSIRT teams around the world to help you handle the ever-increasing volume of incident reports. RTIR…
-
Belkasoft Live RAM Capturer belkasoft.com
Tiny free forensic tool to reliably extract the entire content of the computer’s volatile memory – even if protected by an active anti-debugging or anti-dumping system.
-
Belkasoft Evidence Center belkasoft.com
The toolkit will quickly extract digital evidence from multiple sources by analyzing hard drives, drive images, memory dumps, iOS, Blackberry and Android backups, UFED, JTAG and chip-off dumps.
-
Threat.Zone app.threat.zone
Cloud based threat analysis platform which include sandbox, CDR and interactive analysis for researchers.
-
The Practice of Network Security Monitoring: Understanding Incident Detection and Response amazon.com
Richard Bejtlich's book on IR.
-
Practical Memory Forensics amazon.com
The definitive guide to practice memory forensics. By Svetlana Ostrovskaya and Oleg Skulkin.
-
Operator Handbook: Red Team + OSINT + Blue Team Reference amazon.com
Great reference for incident responders.
-
Intelligence-Driven Incident Response amazon.com
By Scott J. Roberts, Rebekah Brown.
-
Incident Response with Threat Intelligence amazon.com
Great reference to build an incident response plan based also on Threat Intelligence. By Roberto Martinez.
-
Incident Response Techniques for Ransomware Attacks amazon.com
A great guide to build an incident response strategy for ransomware attacks. By Oleg Skulkin.
-
Incident Response & Computer Forensics, Third Edition amazon.com
The definitive guide to incident response.
-
by Gerard Johansen.
-
Crafting the InfoSec Playbook: Security Monitoring and Incident Response Master Plan amazon.com
by Jeff Bollinger, Brandon Enright and Matthew Valites.
-
Art of Memory Forensics amazon.com
Detecting Malware and Threats in Windows, Linux, and Mac Memory.
-
Applied Incident Response amazon.com
Steve Anson's book on Incident Response.
-
AccessData FTK Imager accessdata.com
Forensics tool whose main purpose is to preview recoverable data from a disk of any kind. FTK Imager can also acquire live memory and paging file on 32bit and 64bit systems.
