Incident Response
218 items from meirwah/awesome-incident-response ★9,444
-
virustotal virustotal.com
VirusTotal, a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners. At the same time, it may be used as a means…
-
Rekall rekall-forensic.com
Open source tool (and library) for the extraction of digital artifacts from volatile memory (RAM) samples.
-
any.run app.any.run
Interactive online malware analysis service for dynamic and static research of most types of threats using any environment.
-
KnockKnock objective-see.com
See what's persistently installed on your Mac.
-
osquery osquery.io
osquery is an instrumentation framework that expose the operating system as a high-performance relational database.
-
TheHive thehive-project.org
Scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly.
-
PagerDuty Incident Response Documentation response.pagerduty.com
Documents that describe parts of the PagerDuty Incident Response process. It provides information not only on preparing for an incident, but also what to do during and after. Source is available on GitHub.
-
Redline fireeye.com
Provides host investigative capabilities to users to find signs of malicious activity through memory and file analysis, and the development of a threat assessment profile.
-
Hybrid Analysis hybrid-analysis.com
Free powerful online sandbox by CrowdStrike.
-
CRITs crits.github.io
Web-based tool which combines an analytic engine with a cyber threat database.
-
Intezer analyze.intezer.com
Intezer Analyze dives into Windows binaries to detect micro-code similarities to known threats, in order to provide accurate yet easy-to-understand results.
-
Zenduty zenduty.com
Zenduty is a novel incident management platform providing end-to-end incident alerting, on-call management and response orchestration, giving teams greater control and automation over the incident management lifecycle.
-
Yomi yomi.yoroi.company
Free MultiSandbox managed and hosted by Yoroi.
-
X-Ways Forensics x-ways.net
Forensics tool for Disk cloning and imaging. It can be used to find deleted files and disk analysis.
-
WindowsSCOPE windowsscope.com
Memory forensics and reverse engineering tool used for analyzing volatile memory offering the capability of analyzing the Windows kernel, drivers, DLLs, and virtual and physical memory.
-
Valkyrie Comodo valkyrie.comodo.com
Valkyrie uses run-time behavior and hundreds of features from a file to perform analysis.
-
The ESF Playground themittenmac.com
A tool to view the events in Apple Endpoint Security Framework (ESF) in real time.
-
Kaspersky CyberTrace support.kaspersky.com
Threat intelligence fusion and analysis tool that integrates threat data feeds with SIEM solutions. Users can immediately leverage threat intelligence for security monitoring and incident report (IR) activities in the workflow of their existing security operations.
-
PALADIN sumuri.com
Modified Linux distribution to perform various forensics task in a forensically sound manner. It comes with many open source forensics tools included.
-
Open Computer Forensics Architecture sourceforge.net
Another popular distributed open-source computer forensics framework. This framework was built on Linux platform and uses postgreSQL database for storing data.
-
NST - Network Security Toolkit sourceforge.net
Linux distribution that includes a vast collection of best-of-breed open source network security applications useful to the network security professional.
-
The Sleuth Kit & Autopsy sleuthkit.org
Unix and Windows based tool which helps in forensic analysis of computers. It comes with various tools which helps in digital forensics. These tools help in analyzing disk images, performing in-depth analysis of file systems, and various other things.
-
Reverse.IT reverse.it
Alternative domain for the Hybrid-Analysis tool provided by CrowdStrike.
-
X-Ray 2.0 raymond.cc
Windows utility (poorly maintained or no longer maintained) to submit virus samples to AV vendors.
-
RaQet raqet.github.io
Unconventional remote acquisition and triaging tool that allows triage a disk of a remote computer (client) that is restarted with a purposely built forensic operating system.
-
Stalk percona.com
Collect forensic data about MySQL when problems occur.
-
CORTEX XSOAR paloaltonetworks.com
Paloalto security orchestration, automation and response platform with full Incident lifecycle management and many integrations to enhance automations.
-
OSForensics osforensics.com
Tool to acquire live memory on 32-bit and 64-bit systems. A dump of an individual process’s memory space or physical memory dump can be done.
-
PMDump ntsecurity.nu
Tool that lets you dump the memory contents of a process to a file without stopping the process.
-
Scout2 nccgroup.github.io
Security tool that lets Amazon Web Services administrators assess their environment's security posture.
- next page of items loading…
