wagga40 / Zircolite

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

RynezzZ / TrafficAnalyzer

应急响应流量分析工具，支持pcap、excel、log等多种数据源，同时结合加解密、反编译等多个常用工作流。

EmadAbedini / Dumplyzer

Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.