Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

Intel Owl: analyze files, domains, IPs in multiple ways from a single API at scale

FAME Automates Malware Evaluation

A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

Open source incident management and response platform.

Documentation of TheHive

Wazuh - Ruleset

Cortex Analyzers Repository

DFIRTrack - The Incident Response Tracking Application

Python script to decode common encoded PowerShell scripts

A portable OSINT Swiss Army Knife for DFIR/OSINT professionals 🕵️ 🕵️ 🕵️

Imago is a python tool that extract digital evidences from images.

Taxonomies used in MISP taxonomy system and can be used by other information sharing tool.

Oriana is a threat hunting tool that leverages a subset of Windows events to build relationships, calculate totals and run analytics. The results are presented in a Web layer to help defenders identify outliers and suspicious behavior on corporate environments.

A knowledge base of actionable Incident Response techniques

Python API Client for TheHive

PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform

analyze a web-based network traffic 🕶 to detect central command and control servers

Explore Indicators of Compromise Automatically

Extract BITS jobs from QMGR queue and store them as CSV records

An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree view.

Synapse: a Meta Alert Feeder for TheHive, a Security Incident Response Platform

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

A Lambda-powered Security Orchestration framework for AWS GuardDuty

Some dfir stuff

Graph Representation of MITRE ATT&CK's CTI data

Python API Client for Cortex

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

Exporting MISP event attributes to yara rules usable with Thor apt scanner