Ranked by Attention Score: stars gained over the last 180 complete days
35 repositories by Attention Score · May 7, 2026 – Nov 2, 2026 (UTC)
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
A curated list of Site Reliability and Production Engineering resources.
A curated list of tools for incident response
Digging Deeper....
Volatility 3.0 development
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
✨ A curated list of awesome threat detection and hunting resources 🕵️♂️
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
Collaborative Incident Response platform
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
ThePhish: an automated phishing email analysis tool
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
A concise, directive, specific, flexible, and free incident response plan template
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
A collection of postmortem templates
Digital Forensics Investigation Platform
Tenzir is the data pipeline engine for security teams.
Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders
Collection of Event ID ressources useful for Digital Forensics and Incident Response
Forensics artefact collection tool for systems running Microsoft Windows
PagerDuty's Incident Response Documentation.
⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes
simple YARA-based IOC scanner
Cyber Incident Response Team Playbook Battle Cards
DFIRTrack - The Incident Response Tracking Application
Incident Response - Fast suspicious file finder
🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit