bryanegan

trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

jid

json incremental digger

dispatch

All of the ad-hoc things you're doing to manage incidents today, done for you, and much more!

trlx

A repo for distributed training of language models with Reinforcement Learning via Human Feedback (RLHF)

cloudfox

Automating situational awareness for cloud penetration tests.

sof-elk

Configuration files for the SOF-ELK VM

Incident-Playbook

GOAL: Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques. [Contributors Friendly]

requests-ip-rotator

A Python library to utilize AWS API Gateway's large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.

AzureHunter

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

Aurora-Incident-Response

Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders

o365recon

retrieve information via O365 and AzureAD with a valid cred

laurel

Transform Linux Audit logs for SIEM usage

attack-flow

Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.

auto-archiver

Automatically archive links to videos, images, and social media content from Google Sheets (and more).

aftermath

Aftermath is a free macOS IR framework

cloud-forensics-utils

Python library to carry out DFIR analysis on the Cloud

authz0

🔑 Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials.

aws-security-analytics-bootstrap

AWS Security Analytics Bootstrap enables customers to perform security investigations on AWS service logs by providing an Amazon Athena analysis environment that's quick to deploy, ready to use, and easy to maintain.

paranoia

Inspect certificate authorities in container images

assisted-log-enabler-for-aws

Assisted Log Enabler for AWS - Find AWS resources that are not logging, and turn them on.

merloc

MerLoc is a live AWS Lambda function development and debugging tool. MerLoc allows you to run AWS Lambda functions on your local while they are still part of a flow in the AWS cloud remote.

thiri-notebook

The Threat Hunting In Rapid Iterations (THIRI) Jupyter notebook is designed as a research aide to let you rapidly prototype threat hunting rules.

sandbox-accounts-for-events

"Sandbox Accounts for Events" allows to provide multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI.

pypi-aws-secrets

This repo scans pypi for AWS keys

whiskeysamlandfriends

GoldenSAML Attack Libraries and Framework

duvet

redteamcmm

acquire-aws-ec2

A python script to acquire multiple aws ec2 instances in a forensically sound-ish way

Volatility-MM-CS

Volatility MindMap & Cheat Sheet

lambda-rust-and-cdk