A curated list of tools for incident response. With repository stars⭐ and forks🍴
A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams.
Digital Forensics and Incident Response (DFIR) teams are groups of people in an organization responsible for managing the response to a security incident, including gathering evidence of the incident, remediating its effects, and implementing controls to prevent the incident from recurring in the future.
2369⭐
413🍴
APTSimulator) - Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised. 9018⭐
2652🍴
Atomic Red Team (ART)) - Small and highly portable detection tests mapped to the MITRE ATT&CK Framework. 244⭐
64🍴
AutoTTP) - Automated Tactics Techniques & Procedures. Re-running complex sequences manually for regression tests, product evaluations, generate data for researchers. 5164⭐
1006🍴
Caldera) - Automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge (ATT&CK™) project. 964⭐
148🍴
DumpsterFire) - Modular, menu-driven, cross-platform tool for building repeatable, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. 1073⭐
151🍴
Metta) - Information security preparedness tool to do adversarial simulation. 1182⭐
127🍴
Network Flight Simulator) - Lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility. 1031⭐
213🍴
Red Team Automation (RTA)) - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. 1195⭐
182🍴
RedHunt-OS) - Virtual machine for adversary emulation and threat hunting. 634⭐
150🍴
CimSweep) - Suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows. 140⭐
25🍴
CIRTkit) - CIRTKit is not just a collection of tools, but also a framework to aid in the ongoing unification of Incident Response and Forensics investigation processes. 850⭐
58🍴
Dissect) - Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group). 616⭐
95🍴
Doorman) - osquery fleet manager that allows remote management of osquery configurations retrieved by nodes. It takes advantage of osquery's TLS configuration, logger, and distributed read/write endpoints, to give administrators visibility across a fleet of devices with minimal overhead and intrusiveness. 183⭐
60🍴
Falcon Orchestrator) - Extendable Windows-based application that provides workflow automation, case management and security response functionality. 5832⭐
858🍴
Flare) - A fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing. 2111⭐
346🍴
Fleetdm) - State of the art host monitoring platform tailored for security experts. Leveraging Facebook's battle-tested osquery project, Fleetdm delivers continuous updates, features and fast answers to big questions. 4647⭐
759🍴
GRR Rapid Response) - Incident response framework focused on remote live forensics. It consists of a python agent (client) that is installed on target systems, and a python server infrastructure that can manage and talk to the agent. Besides the included Python API client, 56⭐
7🍴
PowerGRR) provides an API client library in PowerShell working on Windows, Linux and macOS for GRR automation and scripting. 930⭐
139🍴
IRIS) - IRIS is a web collaborative platform for incident response analysts allowing to share investigations at a technical level. 717⭐
108🍴
Kuiper) - Digital Forensics Investigation Platform 1351⭐
87🍴
Matano): Open source serverless security lake platform on AWS that lets you ingest, store, and analyze petabytes of security data into an Apache Iceberg data lake and run realtime Python detections as code. 2173⭐
327🍴
MozDef) - Automates the security incident handling process and facilitate the real-time activities of incident handlers. 41⭐
6🍴
MutableSecurity) - CLI program for automating the setup, configuration, and use of cybersecurity solutions. 597⭐
139🍴
nightHawk) - Application built for asynchronous forensic data presentation using ElasticSearch as the backend. It's designed to ingest Redline collections. 308⭐
41🍴
SOC Multi-tool) - A powerful and user-friendly browser extension that streamlines investigations for security professionals. 2644⭐
445🍴
Velociraptor) - Endpoint visibility and collection tool 719⭐
89🍴
Zentral) - Combines osquery's powerful endpoint inventory features with a flexible notification and action framework. This enables one to identify and react to changes on OS X and Linux clients. 438⭐
105🍴
Bitscout) - Bitscout by Vitaly Kamluk helps you build your fully-trusted customizable LiveCD/LiveUSB image to be used for remote digital forensics (or perhaps any other task of your choice). It is meant to be transparent and monitorable by the owner of the system, forensically sound, customizable and compact. 74⭐
17🍴
Acquire) - Acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container. This makes Acquire an excellent tool to, among others, speedup the process of digital forensic triage. It uses 850⭐
58🍴
Dissect) to gather that information from the raw disk, if possible. 238⭐
18🍴
artifactcollector) - The artifactcollector project provides a software that collects forensic artifacts on systems. 997⭐
179🍴
bulk_extractor) - Computer forensics tool that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. Because of ignoring the file system structure, the program distinguishes itself in terms of speed and thoroughness. 327⭐
52🍴
Cold Disk Quick Response) - Streamlined list of parsers to quickly analyze a forensic image file (dd
, E01, .vmdk
, etc) and output nine reports. 600⭐
88🍴
CyLR) - The CyLR tool collects forensic artifacts from hosts with NTFS file systems quickly, securely and minimizes impact to the host. 979⭐
201🍴
Forensic Artifacts) - Digital Forensics Artifact Repository 447⭐
93🍴
ir-rescue) - Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response. 236⭐
50🍴
Margarita Shotgun) - Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition. 31⭐
3🍴
SPECTR3) - Acquire, triage and investigate remote evidence via portable iSCSI readonly access 605⭐
101🍴
UAC) - UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts. 268⭐
32🍴
Catalyst) - A free SOAR system that helps to automate alert handling and incident response processes. 273⭐
67🍴
DFTimewolf) - A framework for orchestrating forensic collection, processing and data export. 466⭐
75🍴
DFIRTrack) - Incident Response tracking application handling one or more incidents via cases and tasks with a lot of affected systems and artifacts. ?⭐
?🍴
Fast Incident Response (FIR)) - Cybersecurity incident management platform designed with agility and speed in mind. It allows for easy creation, tracking, and reporting of cybersecurity incidents and is useful for CSIRTs, CERTs and SOCs alike. 242⭐
48🍴
Sandia Cyber Omni Tracker (SCOT)) - Incident Response collaboration and knowledge capture tool focused on flexibility and ease of use. Our goal is to add value to the incident response process without burdening the user. 1251⭐
297🍴
Shuffle) - A general purpose security automation platform focused on accessibility. 422⭐
97🍴
threat_note) - Lightweight investigation notebook that allows security researchers the ability to register and retrieve indicators related to their research. 69⭐
15🍴
Digital Forensics Artifact Knowledge Base) - Digital Forensics Artifact Knowledge Base 2126⭐
392🍴
Windows Events Attack Samples) - Windows Events Attack Samples 151⭐
19🍴
Windows Registry Knowledge Base) - Windows Registry Knowledge Base 479⭐
71🍴
CCF-VM) - CyLR CDQR Forensics Virtual Machine (CCF-VM): An all-in-one solution to parsing collected data, making it easily searchable with built-in common searches, enable searching of single and multiple hosts simultaneously. 3057⭐
518🍴
Security Onion) - Special Linux distro aimed at network security monitoring featuring advanced analysis tools. 165⭐
42🍴
FastIR Collector Linux) - FastIR for Linux collects different artifacts on live Linux and records the results in CSV files. 123⭐
15🍴
MAGNET DumpIt) - Fast memory acquisition open source tool for Linux written in Rust. Generate full memory crash dumps of Linux machines. 188⭐
26🍴
AppCompatProcessor) - AppCompatProcessor has been designed to extract additional value from enterprise-wide AppCompat / AmCache data beyond the classic stacking and grepping techniques. 1143⭐
227🍴
APT Hunter) - APT-Hunter is Threat Hunting tool for windows event logs. 2539⭐
227🍴
Chainsaw) - Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows event logs. 1918⭐
166🍴
Hayabusa) - Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool created by the Yamato Security group in Japan. 207⭐
50🍴
Lorg) - Tool for advanced HTTPD logfile security analysis and forensics. 138⭐
22🍴
Logdissect) - CLI utility and Python API for analyzing log files and other data. 2626⭐
439🍴
LogonTracer) - Tool to investigate malicious Windows logon by visualizing and analyzing Windows event log. 7591⭐
2087🍴
Sigma) - Generic signature format for SIEM systems already containing an extensive ruleset. 2828⭐
333🍴
StreamAlert) - Serverless, real-time log data analysis framework, capable of ingesting custom data sources and triggering alerts using user-defined logic. 408⭐
59🍴
SysmonSearch) - SysmonSearch makes Windows event log analysis more effective and less time consuming by aggregation of event logs. 675⭐
74🍴
WELA) - Windows Event Log Analyzer aims to be the Swiss Army knife for Windows event logs. 593⭐
83🍴
Zircolite) - A standalone and fast SIGMA-based detection tool for EVTX or JSON. 805⭐
75🍴
AVML) - A portable volatile memory acquisition tool for Linux. 259⭐
42🍴
Evolve) - Web interface for the Volatility Memory Forensics Framework. 276⭐
57🍴
inVtero.net) - Advanced memory analysis for Windows x64 with nested hypervisor support. 1630⭐
330🍴
LiME) - Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD. 467⭐
68🍴
MalConfScan) - MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a function to list strings to which malicious code refers. 189⭐
17🍴
Orochi) - Orochi is an open source framework for collaborative forensic memory dump analysis. 6912⭐
1247🍴
Volatility) - Advanced memory forensics framework. 2197⭐
363🍴
Volatility 3) - The volatile memory extraction framework (successor of Volatility) 259⭐
59🍴
VolatilityBot) - Automation tool for researchers cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation. 192⭐
50🍴
VolDiff) - Malware Memory Footprint Analysis based on Volatility. ?⭐
?🍴
Linux Memory Grabber) - Script for dumping Linux memory and creating Volatility profiles. 714⭐
98🍴
macOS Artifact Parsing Tool (mac_apt)) - Plugin based forensics framework for quick mac triage that works on live machines, disk images or individual artifact files. 3131⭐
282🍴
OSX Auditor) - Free Mac OS X computer forensics tool. 1861⭐
240🍴
OSX Collector) - OSX Auditor offshoot for live response. 539⭐
83🍴
Awesome Event IDs) - Collection of Event ID resources useful for Digital Forensics and Incident Response. 3567⭐
591🍴
Awesome Forensics) - A curated list of awesome forensic analysis tools and resources. 1829⭐
500🍴
Didier Stevens Suite) - Tool collection 837⭐
128🍴
List of various Security APIs) - Collective list of public JSON APIs for use in security. 635⭐
60🍴
Diffy) - DFIR tool developed by Netflix's SIRT that allows an investigator to quickly scope a compromise across cloud instances (Linux instances on AWS, currently) during an incident and efficiently triaging those instances for followup actions by showing differences against a baseline. 20⭐
3🍴
domfind) - Python DNS crawler for finding identical domain names under different TLDs. 113⭐
25🍴
Fileintel) - Pull intelligence per file hash. 3690⭐
672🍴
HELK) - Threat Hunting platform. 1014⭐
134🍴
Hindsight) - Internet history forensics for Google Chrome/Chromium. 258⭐
52🍴
Hostintel) - Pull intelligence per host. 111⭐
36🍴
imagemounter) - Command line utility and Python package to ease the (un)mounting of forensic disk images. ?⭐
?🍴
Kansa) - Modular incident response framework in PowerShell. 276⭐
30🍴
MFT Browser) - MFT directory tree reconstruction & record info. 796⭐
147🍴
Munin) - Online hash checker for VirusTotal and other services. 36⭐
6🍴
PowerSponse) - PowerSponse is a PowerShell module focused on targeted containment and remediation during security incident response. 25⭐
4🍴
PyaraScanner) - Very simple multi-threaded many-rules to many-files YARA scanning Python script for malware zoos and IR. 233⭐
53🍴
rastrea2r) - Allows one to scan disks and memory for IOCs using YARA on Windows, Linux and OS X. 933⭐
123🍴
Raccine) - A Simple Ransomware Protection 1788⭐
231🍴
Stenographer) - Packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. It stores as much history as it possible, managing disk usage, and deleting when disk limits are hit. It's ideal for capturing the traffic just before and during an incident, without the need explicit need to store all of the network traffic. 65⭐
15🍴
sqhunter) - Threat hunter based on osquery and Salt Open (SaltStack) that can issue ad-hoc or distributed queries without the need for osquery's tls plugin. sqhunter allows you to query open network sockets and check them against threat intelligence sources. 4561⭐
1667🍴
sysmon-config) - Sysmon configuration file template with default high-quality event tracing 2481⭐
565🍴
sysmon-modular) - A repository of sysmon configuration modules 36⭐
9🍴
traceroute-circl) - Extended traceroute to support the activities of CSIRT (or CERT) operators. Usually CSIRT team have to handle incidents based on IP addresses received. Created by Computer Emergency Response Center Luxembourg. 873⭐
167🍴
AWS Incident Response Runbook Samples) - AWS IR Runbook Samples meant to be customized per each entity using them. The three samples are: "DoS or DDoS attack", "credential leakage", and "unintended access to an Amazon S3 bucket". 556⭐
202🍴
Counteractive Playbooks) - Counteractive PLaybooks collection. 330⭐
58🍴
GuardSIght Playbook Battle Cards) - A collection of Cyber Incident Response Playbook Battle Cards 876⭐
136🍴
IRM) - Incident Response Methodologies by CERT Societe Generale. 1006⭐
222🍴
GitHub). 451⭐
190🍴
Phantom Community Playbooks) - Phantom Community Playbooks for Splunk but also customizable for other use. 3859⭐
792🍴
ThreatHunter-Playbook) - Playbook to aid the development of techniques and hypothesis for hunting campaigns. 3837⭐
492🍴
CAPA) - detects capabilities in executable files. You run it against a PE, ELF, .NET module, or shellcode file and it tells you what it thinks the program can do. 1647⭐
374🍴
CAPEv2) - Malware Configuration And Payload Extraction. 5404⭐
1684🍴
Cuckoo) - Open Source Highly configurable sandboxing tool. 388⭐
178🍴
Cuckoo-modified) - Heavily modified Cuckoo fork developed by community. 18⭐
7🍴
Cuckoo-modified-api) - Python library to control a cuckoo-modified sandbox. 14903⭐
1122🍴
Cutter) - Free and Open Source Reverse Engineering Platform powered by rizin. 47466⭐
5527🍴
Ghidra) - Software Reverse Engineering Framework. 171⭐
39🍴
Mastiff) - Static analysis framework that automates the process of extracting key characteristics from a number of different file formats. 19586⭐
2935🍴
Radare2) - Reverse engineering framework and command-line toolset. 2423⭐
330🍴
Rizin) - UNIX-like reverse engineering framework and command-line toolset 644⭐
123🍴
StringSifter) - A machine learning tool that ranks strings based on their relevance for malware analysis. 1533⭐
351🍴
Viper) - Python based binary analysis and management framework, that works well with Cuckoo and YARA. 134⭐
36🍴
Visualize_Logs) - Open source visualization library and command line tools for logs (Cuckoo, Procmon, more to come). 661⭐
103🍴
Fenrir) - Simple IOC scanner. It allows scanning any Linux/Unix/OSX system for IOCs in plain bash. Created by the creators of THOR and LOKI. 3218⭐
572🍴
LOKI) - Free IR scanner for scanning endpoint with yara rules and other indicators(IOCs). 159⭐
27🍴
Spyre) - Simple YARA-based IOC scanner written in Go 727⭐
78🍴
Aurora Incident Response) - Platform developed to build easily a detailed timeline of an incident. 1011⭐
133🍴
Morgue) - PHP Web app by Etsy for managing postmortems. 1619⭐
324🍴
Plaso) - a Python-based backend engine for the tool log2timeline. 2484⭐
563🍴
Timesketch) - Open source tool for collaborative forensic timeline analysis. 176⭐
31🍴
AChoir) - Framework/scripting tool to standardize and simplify the process of scripting live acquisition utilities for Windows. 356⭐
40🍴
GitHub). 501⭐
135🍴
FastIR Collector) - Tool that collects different artifacts on live Windows systems and records the results in csv files. With the analyses of these artifacts, an early compromise can be detected. 2072⭐
182🍴
Fibratus) - Tool for exploration and tracing of the Windows kernel. 187⭐
18🍴
Hoarder) - Collecting the most valuable artifacts for forensics or incident response investigations. 144⭐
29🍴
Invoke-LiveResponse) - Invoke-LiveResponse is a live response tool for targeted collection. 123⭐
26🍴
IRTriage) - Incident Response Triage - Windows Evidence Collection for Forensic Analysis. 3218⭐
572🍴
LOKI) - Free IR scanner for scanning endpoint with yara rules and other indicators(IOCs). 424⭐
84🍴
MEERKAT) - PowerShell-based triage and threat hunting for Windows. 38⭐
6🍴
Panorama) - Fast incident overview on live Windows systems. 1357⭐
276🍴
PowerForensics) - Live disk forensics platform, using PowerShell. ?⭐
?🍴
PSRecon) - PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally. 482⭐
119🍴
RegRipper) - Open source tool, written in Perl, for extracting/parsing information (keys, values, data) from the Registry and presenting it for analysis. 7107⭐
1480🍴
meirwah/awesome-incident-response)