Automate the creation of a lab environment complete with security tooling and logging best practices

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

A curated list of tools for incident response. With repository stars⭐ and forks🍴

Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.

Graph Visualization for windows event logs

Cyber Range including Velociraptor + HELK system with a Windows VM for security testing and R&D. Azure and AWS terraform support.

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

Analyse a forensic target (such as a directory) to find and report files found and not found from CIRCL hashlookup public service - https://circl.lu/services/hashlookup/

Fast lookup server for NSRL and other hash database used in digital forensic

LLM supported Toolkit for Blue Team/ SOC Operations

unix_collector is a Live Response collection script for Incident Response on UNIX-like systems using native binaries. Supports AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

Pipeline that allows sending forensic artifacts to OpenRelik for automatic processing

MAES: M365 Analyzer & Extractor Suite Po

Simple Imager has been created for performing live acquisition of Windows based systems in a forensically sound manner

Automatically create iSCSI targets for all drives except for a boot device

A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small Velociraptor R&D lab.

Easy automated vagrant provisioning of Windows 10 with flarevm tools installed for Digital Forensics and Malware Analysis Lab.

ActiveMime File Format Documentation

Sabonis, a Digital Forensics and Incident Response pivoting tool

Toolset to analyze disks encrypted with McAFee FDE technology

Outil de triage automatisé de différents types de collectes d'artefacts.

CLI generator for Velociraptor offline collector

Essential playbooks & runbooks for cybersecurity operations. A dynamic resource for security pros to navigate digital threats, with best practices, incident management protocols, and community-driven updates. Elevate your security strategy and response with our AI-driven guides.

🚀 IRIS-SOAR: Modular SOAR (Security Orchestration, Automation, and Response) implementation in Python. Designed to complement DFIR-IRIS through playbook automation and seamless integrations. Easily extensible and in active development. Join us in building a tool geared towards enhancing security efficiency!

Orchestration Software for Incident Response

Kali in a Box - Containerized and fully operational within your Browser

Automated pipeline for generating forensic timelines from Magnet Response collections.

Factual rules are YARA rules to find legitimate software on raw disk acquisition.