incident-response

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.

ThePhish: an automated phishing email analysis tool

AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.

Wazuh - Docker containers

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...

PagerDuty's Incident Response Documentation.

An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it — right from Slack, Telegram, Lark or DingTalk.

FAME Automates Malware Evaluation

A collection of resources for Threat Hunters

Open source templates you can use to bootstrap your security programs

Digital Forensics Investigation Platform

Quickly Extracts IP's, Email Addresses, Hashes, Files, Credit Cards, Social Security Numbers and a lot More From Text

A repository for using osquery for incident detection and response

PowerShell Digital Forensics & Incident Response Scripts.

A concise, directive, specific, flexible, and free incident response plan template

MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs

Tenzir is the data pipeline engine for security teams.

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具

Collection of forensic tools

A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.

A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID

Awesome list of keywords and artifacts for Threat Hunting sessions

This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services.

Collection of Event ID ressources useful for Digital Forensics and Incident Response

PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.