torelab

SystemInspector

SystemInspector is a script to pull a majority of the security-relevant files and settings from a system.

gasmask

Information gathering tool - OSINT

klara

Kaspersky's GReAT KLara

HELK

The Hunting ELK

plast

Modular command-line threat hunting tool & framework.

arkime

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

FIR

Fast Incident Response

CASE

Cyber-investigation Analysis Standard Expression (CASE) Ontology

SIAC

SIAC is an enterprise SIEM built on open-source technology.

training-materials

WEFFLES

Build a fast, free, and effective Threat Hunting/Incident Response Console with Windows Event Forwarding and PowerBI

tenzir

Open source security data pipelines.

scot

Sandia Cyber Omni Tracker (SCOT)

fame

FAME Automates Malware Evaluation

awesome-incident-response

A curated list of tools for incident response

PatrowlEngines

PatrOwl - Open Source, Free and Scalable Security Operations Orchestration Platform

GOSINT

The GOSINT framework is a project used for collecting, processing, and exporting high quality indicators of compromise (IOCs).

python-maec

A Python library for parsing, manipulating, and generating MAEC content.

TheHiveBeeBot

Script for automatically create a case in The Hive and start Cortex analyzers adapted to fit the observables.

n6

Automated handling of data feeds for security teams

omnibus

The OSINT Omnibus (beta release)

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

TheHive

TheHive: a Scalable, Open Source and Free Security Incident Response Platform

MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform