interplains / zero-breach
Zero Breach โ local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
interplains / zero-breach
JoasASantos / Malvex
AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server
pranshuparmar / witr
Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
kubeshark / kubeshark
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
upgundecha / howtheysre
A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)
toniblyx / my-arsenal-of-aws-security-tools
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
meirwah / awesome-incident-response
A curated list of tools for incident response
OneUptime / oneuptime
Complete open-source monitoring and observability platform.
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
volatilityfoundation / volatility3
Volatility 3.0 development
Velocidex / velociraptor
Digging Deeper....
TracecatHQ / tracecat
Open-source security automation platform for teams and AI agents
HolmesGPT / holmesgpt
SRE Agent - CNCF Sandbox Project
Yamato-Security / hayabusa
Hayabusa (้ผ) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
sleuthkit / sleuthkit
The Sleuth Kitยฎ (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
beenuar / AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
mthcht / awesome-lists
Awesome Security lists for SOC/CERT/CTI
nitefood / asn
ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / URL / ASPath / Organization / IP reputation / IP geolocation / IP fingerprinting / Network recon / lookup API server / Web traceroute server
cyb3rxp / awesome-soc
A curated knowledge base to build, run and mature a SOC (including CSIRT).
TheHive-Project / Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
dfir-iris / iris-web
Collaborative Incident Response platform
tclahr / uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
thalesgroup-cert / Watcher
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
ahmedkhlief / APT-Hunter
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity
mrwadams / attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
wazuh / wazuh-docker
Wazuh - Docker containers
ongridio / ongrid
An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it โ right from Slack, Telegram, Lark or DingTalk.
certsocietegenerale / fame
FAME Automates Malware Evaluation
palantir / osquery-configuration
A repository for using osquery for incident detection and response
kai5263499 / osx-security-awesome
A collection of OSX and iOS security resources
tenzir / tenzir
Tenzir is the data pipeline engine for security teams.
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
LETHAL-FORENSICS / Microsoft-Analyzer-Suite
A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
aws-samples / aws-customer-playbook-framework
This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services.
activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
Johnng007 / Live-Forensicator
Cross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation โ designed for fast, actionable security investigations.
utmstack / UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
turbot / tailpipe
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
digitalisx / awesome-memory-forensics
A curated list of awesome Memory Forensics for DFIR
CybercentreCanada / assemblyline
Assemblyline 4: File triage and malware analysis
google / mcp-security
โ
jmpsec / osctrl
Fast and efficient osquery management
wazuh / wazuh-dashboard-plugins
Plugins for Wazuh Dashboard
Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
oxynote / oxynote
An openโsource technical wiki connected to the systems it describes
MangoGreenTeaz / FaultLens
Local-first, explainable log incident diagnosis for developers and CI/CD.
sagar2395 / snowopslabs
Learn platform engineering by breaking and fixing real Kubernetes clusters.
shanananana / deepticket
An AI troubleshooting workbench for internal systems: it integrates ticketing and alerting systems via HTTP APIs and webhooks, connects code, logs, configurations, and agents, and provides a web-based self-service analysis interface for product, operations, and customer support teams.
dobzabolotskikh598-cloud / roblox-session-guardian
Roblox Session Guard 2026: Anti Cookie Stealer Token Cleaner for Safe Gaming
riveerxd / nightbell
Android uptime monitoring with no server and no account. Checks run on your phone; an outage arrives as a full-screen page with a looping alarm instead of a notification you swipe away.
elsechord / CyberGuard
Evidence-driven autonomous SOC team on AgentTeams: hash-bound approvals, HMAC audit chain, rollback and reproducible attack scenarios โ auditable governance primitives for agent infrastructure.
RynezzZ / TrafficAnalyzer
ๅบๆฅๅๅบๆต้ๅๆๅทฅๅ ท๏ผๆฏๆpcapใexcelใlog็ญๅค็งๆฐๆฎๆบ๏ผๅๆถ็ปๅๅ ่งฃๅฏใๅ็ผ่ฏ็ญๅคไธชๅธธ็จๅทฅไฝๆตใ
tsale / jevline
Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.
MarinJursic / production-readiness-checklist
Evidence-driven production readiness checklist for shipping web applications with confidence
coroot / rca-lab
A Kubernetes lab that reproduces real production incidents on a live, instrumented microservice stack โ for testing root-cause-analysis tools and agents.
superloglabs / responder-oss
Self-hostable incident-investigation agents for Sentry, Datadog, and Slack.
EmadAbedini / Dumplyzer
Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
incident-io / sdk-ruby
The official incident.io Ruby SDK
prox0959 / CyberCodex
Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python