A concise, directive, specific, flexible, and free incident response plan template
Repository Index
47,133 repositories indexed
25–48 of 50 · Most stars
A collection of OSX and iOS security resources
- mac-osx
- osx-security
- malware
- osx-incident-response
Tenzir is the data pipeline engine for security teams.
- incident-response
- threathunting
- siem
- soc
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
Collection of Event ID ressources useful for Digital Forensics and Incident Response
DFIRTrack - The Incident Response Tracking Application
- incident-response
- digital-forensics
- dfir
- incident-response-tooling
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
An open‑source technical wiki connected to the systems it describes
- confluence-alternative
- dashboard
- incident-response
- internal-documentation
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
- cybersecurity
- incident-response
- sysinternals
- nirsoft
Forensics artefact collection tool for systems running Microsoft Windows
- dfir
- incident-response
- collection
Cyber Incident Response Team Playbook Battle Cards
- playbook-battle-cards
- cybersecurity
- cyber-threats
- cyber-security-team
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
- cybersecurity
- cybersecurity-tools
- incident-response
- security
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
Sandia Cyber Omni Tracker (SCOT)
- perl
- javascript
- cyber-security
- incident-response
simple YARA-based IOC scanner
- yara
- ioc
- security
- incident-response
Invoke-LiveResponse
- ir
- dfir
- winrm
- liveresponse
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit
analyze a web-based network traffic 🕶 to detect central command and control servers
- squid
- network-traffic
- proxy-server
- incident-response
Defensomania is a security monitoring and incident response card game.
- incident-response
- self-assessment
- incident-response-readiness
- educational-game
Mimicry is a dynamic deception tool that actively deceives an attacker during exploitation and post-exploitation.
PowerGRR is an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.
- powershell
- powershell-modules
- incident-response
- containment
A simple many-rules to many-files YARA scanner for incident response or malware zoos.
- yara
- yara-scanner
- incident-response
- dfir