Repository Index

Collaborative forensic timeline analysis

• forensics
• dfir
• security
• timeline

Investigate malicious Windows logon by visualizing and analyzing Windows event log

• security
• dfir
• javascript
• visualization

KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.

• azure
• defender-for-endpoint
• dfir
• kql

Extract and aggregate threat intelligence.

• ioc
• indicators-of-compromise
• threatintel
• threat-intelligence

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

• security
• dfir
• forensics