A collection of postmortem templates
- site-reliability-engineering
- site-reliability
- devops
- postmortem
Repository Index
47,133 repositories indexed
25–48 of 79 · Most stars
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
- threat-hunting
- purpleteam
- python3
- windows-eventlog
ThePhish: an automated phishing email analysis tool
A repository for using windows event forwarding for incident detection and response
- octo-correct-managed
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
- digital-security
- forensics
- incident-response
- ioc
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
- dfir
- dissect
- python
Incident Response Methodologies 2022
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
- cybersecurity
- threat
- ioc
- malware
The repository host gives no description.
Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
- incident-response
- incident-management
- incident-response-tooling
PagerDuty's Incident Response Documentation.
- pagerduty
- incident-response
- documentation
- oncall
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
kwatch runs inside your Kubernetes cluster, traces every failure to its root cause, and sends one message: what broke, why, who changed it and what to do next.
- kubernetes
- monitoring
- k8s
- kwatch
Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
A framework for developing alerting and detection strategies for incident response.
- octo-correct-managed
Digital Forensics Investigation Platform
- dfir
- security
- incident-response
- artifacts
🏇 A Swift HTTP / HTTPS networking library just incidentally execute on machines
A concise, directive, specific, flexible, and free incident response plan template
A collection of OSX and iOS security resources
- mac-osx
- osx-security
- malware
- osx-incident-response
Tenzir is the data pipeline engine for security teams.
- incident-response
- threathunting
- siem
- soc
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Collection of Event ID ressources useful for Digital Forensics and Incident Response
CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.
:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.