Incident response

Tools for triage, containment, and threat hunting after a compromise

1–100 of 172

ImpactToolCategoryStarsUpdated

Local onlyosqueryosquery/osqueryA tool that lets you query the state of an operating system, such as running processes, listening ports, users, and startup items, with SQL.Defense and hardening / Incident response23,6742026-10-23 Not ratednightingaleccfos/nightingaleReview coming soon (opens GitHub in a new tab)Network / Incident response13,3832026-10-22 Not ratedatomic-red-teamredcanaryco/atomic-red-teamReview coming soon (opens GitHub in a new tab)Incident response12,7182026-10-21 Not ratedsigmasigmahq/sigmaReview coming soon (opens GitHub in a new tab)Incident response / Network / Defense and hardening11,3332026-10-21 Not ratedlolbaslolbas-project/lolbasReview coming soon (opens GitHub in a new tab)Learning and practice labs / Red teaming and C2 / Incident response8,9022026-09-26 Not ratedgraylog2-servergraylog2/graylog2-serverReview coming soon (opens GitHub in a new tab)Incident response8,1632026-10-23 Not ratedsysmon-configswiftonsecurity/sysmon-configReview coming soon (opens GitHub in a new tab)Defense and hardening / Incident response5,7062024-07-03 Not ratedemergency-response-notesbypass007/emergency-response-notesReview coming soon (opens GitHub in a new tab)Incident response / Learning and practice labs5,5742023-06-26 Not ratedgrrgoogle/grrReview coming soon (opens GitHub in a new tab)Incident response5,1032026-10-01 Not rateddjango-defectdojodefectdojo/django-defectdojoReview coming soon (opens GitHub in a new tab)Vulnerability scanning / Containers and cloud / Incident response5,0932026-10-24 Not ratedsecurityonionsecurity-onion-solutions/securityonionReview coming soon (opens GitHub in a new tab)Incident response / Defense and hardening4,9382026-10-23 Not ratedawesome-threat-detection0x4d31/awesome-threat-detectionReview coming soon (opens GitHub in a new tab)Learning and practice labs / Incident response4,7682026-01-05 Not ratedthreathunter-playbookotrf/threathunter-playbookReview coming soon (opens GitHub in a new tab)Incident response / Defense and hardening4,7012026-01-12 Not ratedmalwoverviewalexandreborges/malwoverviewReview coming soon (opens GitHub in a new tab)Vulnerability scanning / Incident response / Malware analysis4,1352026-09-22 Not ratedhelkcyb3rward0g/helkReview coming soon (opens GitHub in a new tab)Containers and cloud / Incident response3,9342024-06-01 Not ratedchainsawwithsecureopensource/chainsawReview coming soon (opens GitHub in a new tab)Forensics / Incident response3,6982026-10-14 Not ratedhayabusayamato-security/hayabusaReview coming soon (opens GitHub in a new tab)Incident response / Forensics3,4142026-10-24 Not ratedaisocbeenuar/aisocReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence3,2962026-10-24 Not rateddigital-forensics-guidemikeroyal/digital-forensics-guideReview coming soon (opens GitHub in a new tab)Reconnaissance / Incident response / Threat intelligence3,1952024-01-04 Not ratedsysmon-modularolafhartong/sysmon-modularReview coming soon (opens GitHub in a new tab)Defense and hardening / Incident response3,1692026-10-14 Not ratedapt_reportblackorbird/apt_reportReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence3,1022026-10-19 Not ratedprocdump-linuxmicrosoft/procdump-linuxReview coming soon (opens GitHub in a new tab)Incident response3,0862026-10-20 Not rateddetection-ruleselastic/detection-rulesReview coming soon (opens GitHub in a new tab)Incident response2,9382026-10-24 Not ratedosint-brazucaosintbrazuca/osint-brazucaReview coming soon (opens GitHub in a new tab)Reconnaissance / Incident response / Threat intelligence2,8082026-10-16 Not ratedaptsimulatornextronsystems/aptsimulatorReview coming soon (opens GitHub in a new tab)Incident response2,7832025-09-23 Not ratedredelkoutflanknl/redelkReview coming soon (opens GitHub in a new tab)Incident response2,6842026-10-10 Not ratedevtx-attack-samplessbousseaden/evtx-attack-samplesReview coming soon (opens GitHub in a new tab)Forensics / Incident response2,6402023-01-24 Not ratedattack_rangesplunk/attack_rangeReview coming soon (opens GitHub in a new tab)Learning and practice labs / Incident response2,5722026-10-20 Not ratedfibratusrabbitstack/fibratusReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response / Defense and hardening2,5572026-10-19 Not ratedattack-navigatormitre-attack/attack-navigatorReview coming soon (opens GitHub in a new tab)Threat intelligence / Incident response2,4842026-10-20 Not ratedshuffleshuffle/shuffleReview coming soon (opens GitHub in a new tab)Web security / Incident response2,4612026-10-23 Not rateddeepblueclisans-blue-team/deepbluecliReview coming soon (opens GitHub in a new tab)Forensics / Incident response2,4422023-10-14 Not rateddettectrabobank-cdc/dettectReview coming soon (opens GitHub in a new tab)Incident response2,3512026-10-19 Not ratedmozdefmozilla/mozdefReview coming soon (opens GitHub in a new tab)Incident response2,1582021-11-02 Not ratedpersistencesniperlast-byte/persistencesniperReview coming soon (opens GitHub in a new tab)Incident response2,1472024-12-11 Not ratedlinuxcheckal0ne/linuxcheckReview coming soon (opens GitHub in a new tab)Incident response2,1132024-06-19 Not ratedfircertsocietegenerale/firReview coming soon (opens GitHub in a new tab)Incident response2,0472026-09-14 Not ratedyetiyeti-platform/yetiReview coming soon (opens GitHub in a new tab)Reconnaissance / Incident response / Threat intelligence2,0412026-10-22 Not ratedawesome-listsmthcht/awesome-listsReview coming soon (opens GitHub in a new tab)Threat intelligence / Learning and practice labs / Incident response1,9512026-10-24 Not ratedawesome-soccyb3rxp/awesome-socReview coming soon (opens GitHub in a new tab)Incident response1,9052026-10-20 Not ratedthreathuntingthreathuntingproject/threathuntingReview coming soon (opens GitHub in a new tab)Incident response1,8962021-11-17 Not ratedosxcollectoryelparchive/osxcollectorReview coming soon (opens GitHub in a new tab)Incident response1,8892019-06-19 Not ratedsof-elkphilhagen/sof-elkReview coming soon (opens GitHub in a new tab)Forensics / Incident response1,7602026-09-15 Not ratedinvestigationsamnestytech/investigationsReview coming soon (opens GitHub in a new tab)Threat intelligence / Incident response1,7212024-12-16 Not ratedphp2shell-pocikow/php2shell-pocReview coming soon (opens GitHub in a new tab)Web security / Vulnerability scanning / Incident response1,7072026-10-22 Not ratedmatanomatanolabs/matanoReview coming soon (opens GitHub in a new tab)Containers and cloud / Incident response1,7032025-01-08 Not ratedsysmontoolsnshalabi/sysmontoolsReview coming soon (opens GitHub in a new tab)Incident response / Defense and hardening / Threat intelligence1,6692026-04-04 Not ratedkansadavehull/kansaReview coming soon (opens GitHub in a new tab)Incident response1,6672022-11-22 Not ratedsentinel-queriesreprise99/sentinel-queriesReview coming soon (opens GitHub in a new tab)Incident response1,6582026-01-29 Not ratedcortexthehive-project/cortexReview coming soon (opens GitHub in a new tab)Incident response1,6352026-10-20 Not ratednotifyprojectdiscovery/notifyReview coming soon (opens GitHub in a new tab)Incident response1,6212026-10-23 Not ratediris-webdfir-iris/iris-webReview coming soon (opens GitHub in a new tab)Incident response1,6042026-10-22 Not rateduactclahr/uacReview coming soon (opens GitHub in a new tab)Incident response1,5002026-10-19 Not ratedwatcherthalesgroup-cert/watcherReview coming soon (opens GitHub in a new tab)Threat intelligence / Reconnaissance / Incident response1,4352026-10-19 Not ratedapt-hunterahmedkhlief/apt-hunterReview coming soon (opens GitHub in a new tab)Incident response1,4322026-09-20 Not ratedsparrowcisagov/sparrowReview coming soon (opens GitHub in a new tab)Incident response / Containers and cloud1,4322022-12-27 Not ratedflightsimalphasoc/flightsimReview coming soon (opens GitHub in a new tab)Incident response1,3662024-04-04 Not ratedbeagleyampelo/beagleReview coming soon (opens GitHub in a new tab)Incident response1,3592022-12-13 Not ratedattackdetectionptresearch/attackdetectionReview coming soon (opens GitHub in a new tab)Incident response1,3572022-08-31 Not ratedbluespawnion28/bluespawnReview coming soon (opens GitHub in a new tab)Defense and hardening / Incident response1,3492026-03-31 Not ratedwindows-event-forwardingpalantir/windows-event-forwardingReview coming soon (opens GitHub in a new tab)Forensics / Incident response1,3452026-10-02 Not ratedjarmsalesforce/jarmReview coming soon (opens GitHub in a new tab)Cryptography and passwords / Incident response1,3262026-08-13 Not ratedwhids0xrawsec/whidsReview coming soon (opens GitHub in a new tab)Defense and hardening / Network / Incident response1,3202023-02-25 Not ratedredhunt-osredhuntlabs/redhunt-osReview coming soon (opens GitHub in a new tab)Incident response1,3202025-01-22 Not ratedthreatpursuit-vmmandiant/threatpursuit-vmReview coming soon (opens GitHub in a new tab)Incident response1,3042023-06-01 Not ratedossemotrf/ossemReview coming soon (opens GitHub in a new tab)Incident response1,3022023-02-27 Not ratedmalware-exhibitalvin-tosh/malware-exhibitReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response / Cryptography and passwords1,1932024-01-12 Not ratedthreathuntingolafhartong/threathuntingReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence1,1892023-07-26 Not ratedrtaendgameinc/rtaReview coming soon (opens GitHub in a new tab)Incident response1,1002019-05-01 Not ratedkunaikunai-project/kunaiReview coming soon (opens GitHub in a new tab)Incident response1,0972026-10-23 Not ratedaurora-incident-responsecyb3rfox/aurora-incident-responseReview coming soon (opens GitHub in a new tab)Incident response1,0852023-10-05 Not ratedchirpcisagov/chirpReview coming soon (opens GitHub in a new tab)Incident response1,0592021-06-09 Not ratedcarmitre-attack/carReview coming soon (opens GitHub in a new tab)Incident response1,0302025-05-16 Not ratedsnorbysnorby/snorbyReview coming soon (opens GitHub in a new tab)Network / Incident response1,0072023-06-06 Not ratedsecurity-apisjaegeral/security-apisReview coming soon (opens GitHub in a new tab)Incident response / Learning and practice labs9992026-10-01 Not ratedopensquatatenreiro/opensquatReview coming soon (opens GitHub in a new tab)Reconnaissance / Web security / Incident response9872026-08-01 Not ratedopen-source-threat-intel-feedsbert-janp/open-source-threat-intel-feedsReview coming soon (opens GitHub in a new tab)Threat intelligence / Incident response / Red teaming and C29642026-10-24 Not ratedosint_toolkitdev-lu/osint_toolkitReview coming soon (opens GitHub in a new tab)Threat intelligence / Incident response9522026-04-28 Not ratedmiharininoseki/mihariReview coming soon (opens GitHub in a new tab)Reconnaissance / Incident response / Threat intelligence9452026-10-03 Not ratedcyberthreathuntinga3sal0n/cyberthreathuntingReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence9202024-10-15 Not ratedevent-forwarding-guidancensacyber/event-forwarding-guidanceReview coming soon (opens GitHub in a new tab)Forensics / Incident response8932020-11-17 Not ratedkapefilesericzimmerman/kapefilesReview coming soon (opens GitHub in a new tab)Incident response8902026-10-19 Not ratedrefinerybinref/refineryReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response / Cryptography and passwords8782026-10-23 Not ratedlaurelthreathunters-io/laurelReview coming soon (opens GitHub in a new tab)Incident response / Vulnerability scanning8742026-10-19 Not ratedzircolitewagga40/zircoliteReview coming soon (opens GitHub in a new tab)Incident response / Forensics / Defense and hardening8682026-10-20 Not ratedchameleonqeeqbox/chameleonReview coming soon (opens GitHub in a new tab)Defense and hardening / Incident response8422023-08-08 Not ratedsysmon-configion-storm/sysmon-configReview coming soon (opens GitHub in a new tab)Incident response / Defense and hardening8322023-11-05 Not ratedauditd-attackbfuzzy/auditd-attackReview coming soon (opens GitHub in a new tab)Incident response / Vulnerability scanning8262020-07-08 Not ratedkql-threat-hunting-queriescyb3rmik3/kql-threat-hunting-queriesReview coming soon (opens GitHub in a new tab)Incident response8002026-10-24 Not ratedazurehunterdarkquasar/azurehunterReview coming soon (opens GitHub in a new tab)Incident response7952022-10-29 Not ratedtenzirtenzir/tenzirReview coming soon (opens GitHub in a new tab)Network / Incident response7672026-10-23 Not ratedtituspraetorian-inc/titusReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Incident response7492026-10-20 Not ratedmemprocfs-analyzerlethal-forensics/memprocfs-analyzerReview coming soon (opens GitHub in a new tab)Incident response7422026-08-31 Not ratedcylrorlikoski/cylrReview coming soon (opens GitHub in a new tab)Incident response7372022-06-01 Not ratedenablewindowslogsettingsyamato-security/enablewindowslogsettingsReview coming soon (opens GitHub in a new tab)Forensics / Incident response / Defense and hardening7232025-10-03 Not ratedhawkeyemir1ce/hawkeyeReview coming soon (opens GitHub in a new tab)Incident response7122025-07-13 Not ratedfatt0x4d31/fattReview coming soon (opens GitHub in a new tab)Network / Incident response / Defense and hardening6852023-10-28 Not ratedsciriusstamusnetworks/sciriusReview coming soon (opens GitHub in a new tab)Network / Incident response6852026-05-22 Not ratedthreathunting-keywordsmthcht/threathunting-keywordsReview coming soon (opens GitHub in a new tab)Incident response / Malware analysis6812025-08-04 Not ratedritaactivecm/ritaReview coming soon (opens GitHub in a new tab)Red teaming and C2 / Network / Incident response6642026-10-15