interplains / zero-breach
Zero Breach โ local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
interplains / zero-breach
JoasASantos / Malvex
AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server
The-Art-of-Hacking / h4cker
This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. ๐ฅ Also check: https://hackertraining.org
pranshuparmar / witr
Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
upptime / upptime
โฌ๏ธ GitHub Actions uptime monitor & status page by @AnandChowdhary
TwiN / gatus
Automated developer-oriented status page with alerting and incident support
Tracer-Cloud / opensre
Build your own AI SRE agents. The open source toolkit for the AI era.
kubeshark / kubeshark
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
bluewave-labs / Checkmate
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Don't be shy, join here: https://discord.com/invite/NAb6H3UTjK :)
upgundecha / howtheysre
A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)
toniblyx / my-arsenal-of-aws-security-tools
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
meirwah / awesome-incident-response
A curated list of tools for incident response
openstatusHQ / openstatus
Open-source status page, incident response and uptime monitoring
OneUptime / oneuptime
Complete open-source monitoring and observability platform.
SunWeb3Sec / DeFiHackLabs
Reproduce DeFi hacked incidents using Foundry.
StackStorm / st2
StackStorm (aka "IFTTT for Ops") is event-driven automation for auto-remediation, incident responses, troubleshooting, deployments, and more for DevOps and SREs. Includes rules engine, workflow, 160 integration packs with 6000+ actions (see https://exchange.stackstorm.org) and ChatOps. Installer at https://docs.stackstorm.com/install/index.html
pixlcore / xyops
The next generation of Cronicle: open-source job scheduling, visual workflows, server monitoring, alerting, and incident response.
google / grr
GRR Rapid Response: remote live forensics for incident response
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
volatilityfoundation / volatility3
Volatility 3.0 development
Velocidex / velociraptor
Digging Deeper....
TracecatHQ / tracecat
Open-source security automation platform for teams and AI agents
HolmesGPT / holmesgpt
SRE Agent - CNCF Sandbox Project
Yamato-Security / hayabusa
Hayabusa (้ผ) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
sleuthkit / sleuthkit
The Sleuth Kitยฎ (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
beenuar / AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
mthcht / awesome-lists
Awesome Security lists for SOC/CERT/CTI
nitefood / asn
ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / URL / ASPath / Organization / IP reputation / IP geolocation / IP fingerprinting / Network recon / lookup API server / Web traceroute server
cyb3rxp / awesome-soc
A curated knowledge base to build, run and mature a SOC (including CSIRT).
django-helpdesk / django-helpdesk
A Django application to manage tickets for an internal helpdesk. Formerly known as Jutda Helpdesk.
TheHive-Project / Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
dfir-iris / iris-web
Collaborative Incident Response platform
SquadcastHub / awesome-sre-tools
A curated list of Site Reliability and Production Engineering Tools
tclahr / uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
thalesgroup-cert / Watcher
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
ahmedkhlief / APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
CIRCL / AIL-framework
AIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project
palantir / windows-event-forwarding
A repository for using windows event forwarding for incident detection and response
mrwadams / attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
wazuh / wazuh-docker
Wazuh - Docker containers
ongridio / ongrid
An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it โ right from Slack, Telegram, Lark or DingTalk.
fox-it / dissect
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
abahmed / kwatch
Kubernetes incidents, explained. kwatch traces every cluster failure back to its root cause and sends one message: what broke, why, who changed it, and what to do next. Source available (ELv2).
cisagov / untitledgoosetool
Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customerโs Azure Active Directory (AzureAD), Azure, and M365 environments.
certsocietegenerale / fame
FAME Automates Malware Evaluation
qinshihu / itops-agent-platform
China's 1st enterprise multi-agent IT ops platform. LLM-powered auto-remediation for Zabbix/Prometheus. Docker deploy.
palantir / alerting-detection-strategy-framework
A framework for developing alerting and detection strategies for incident response.
palantir / osquery-configuration
A repository for using osquery for incident detection and response
VersusControl / versus-incident
The self-hosted AI SRE agent. You don't have to monitor your systems alone. Versus Incident will keep track of your services, applications, and systems, detect new or unexpected problems, and provide your team with the evidence needed to investigate.
kai5263499 / osx-security-awesome
A collection of OSX and iOS security resources
center-for-threat-informed-defense / attack-flow
Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
tenzir / tenzir
Tenzir is the data pipeline engine for security teams.
MORTEN-BUUR / nordef-matrix-open-control
NORDEF Matrix Open Control: model-independent AI safety belt with 0/1/2 decisions, Ed25519 root gate, replay protection, evidence chain, and incident-pattern eval bank
Cyclenerd / static_status
๐ฆBash script to generate a static status page.
TonyPhipps / SIEM
SIEM Tactics, Techiques, and Procedures
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
LETHAL-FORENSICS / Microsoft-Analyzer-Suite
A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
aws-samples / aws-customer-playbook-framework
This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services.
activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.