Incident response

Tools for triage, containment, and threat hunting after a compromise

101–172 of 172

ImpactToolCategoryStarsUpdated

Not ratedpurplecloudiknowjason/purplecloudReview coming soon (opens GitHub in a new tab)Incident response6602025-03-21 Not ratedosquery-defense-kitchainguard-dev/osquery-defense-kitReview coming soon (opens GitHub in a new tab)Incident response / Defense and hardening6502026-06-26 Not ratedmisp-galaxymisp/misp-galaxyReview coming soon (opens GitHub in a new tab)Threat intelligence / Incident response6492026-10-23 Not ratedevtx-to-mitre-attackmdecrevoisier/evtx-to-mitre-attackReview coming soon (opens GitHub in a new tab)Forensics / Incident response6442026-05-21 Not ratedthreathuntinggossithedog/threathuntingReview coming soon (opens GitHub in a new tab)Incident response6372026-08-14 Not ratedyara-rulesadvanced-threat-research/yara-rulesReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response / Threat intelligence6312025-03-18 Not rateddfir-labsazr43lkn1ght/dfir-labsReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response6102026-09-20 Not ratedpysigmasigmahq/pysigmaReview coming soon (opens GitHub in a new tab)Incident response6012026-10-18 Not rateddetectionlabelkcyberdefenders/detectionlabelkReview coming soon (opens GitHub in a new tab)Incident response / Defense and hardening5782021-12-12 Not ratedscrummagematamorphosis/scrummageReview coming soon (opens GitHub in a new tab)Reconnaissance / Incident response / Threat intelligence5452025-01-02 Not ratedsnitchaixisstudio/snitchReview coming soon (opens GitHub in a new tab)Incident response / Defense and hardening5382026-10-23 Not ratedrustinelkarib0u/rustinelReview coming soon (opens GitHub in a new tab)Defense and hardening / Incident response / Malware analysis5132026-10-20 Not ratedmeerkattonyphipps/meerkatReview coming soon (opens GitHub in a new tab)Reconnaissance / Incident response4832024-11-15 Not ratedfclchenerlich/fclReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response4782021-04-08 Not rateddsiemdefenxor/dsiemReview coming soon (opens GitHub in a new tab)Incident response4462026-08-19 Not ratedadazchristophetd/adazReview coming soon (opens GitHub in a new tab)Incident response / Exploits and PoCs4292024-12-05 Not ratedsoc-multitoolzdhenard42/soc-multitoolReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence4222025-05-13 Not ratedsyswardenduggytuxy/syswardenReview coming soon (opens GitHub in a new tab)Defense and hardening / Containers and cloud / Incident response3992026-10-23 Not ratedagentic-threat-hunting-frameworknebulock-inc/agentic-threat-hunting-frameworkReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence3962026-10-22 Not ratedyara-rulesbartblaze/yara-rulesReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response / Threat intelligence3922026-01-28 Not ratedghostpandaadir05/ghostReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response / Red teaming and C23922026-08-07 Not ratedyara-rulesinquest/yara-rulesReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response3892022-05-11 Not ratedsublime-rulessublime-security/sublime-rulesReview coming soon (opens GitHub in a new tab)Incident response / Red teaming and C23802026-10-24 Not ratedtgspyderdarksight-analytics/tgspyderReview coming soon (opens GitHub in a new tab)Reconnaissance / Incident response3672025-12-14 Not ratedattackdatamapolafhartong/attackdatamapReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence3572020-11-03 Not ratedthreatestdatadog/threatestReview coming soon (opens GitHub in a new tab)Incident response3512026-10-19 Not ratedgrafikilucky-luk3/grafikiReview coming soon (opens GitHub in a new tab)Incident response3412023-05-28 Not ratedlinuxcatscalewithsecurelabs/linuxcatscaleReview coming soon (opens GitHub in a new tab)Incident response3392024-06-25 Not ratedkestrel-langopencybersecurityalliance/kestrel-langReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence3272024-09-27 Not ratedmalware-iocprodaft/malware-iocReview coming soon (opens GitHub in a new tab)Threat intelligence / Incident response3222025-11-04 Not ratedosweepecstatic-nobel/osweepReview coming soon (opens GitHub in a new tab)Reconnaissance / Malware analysis / Incident response3202021-01-26 Not ratedelementalelemental-attack/elementalReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence3182022-12-08 Not ratedclawdstrikebackbay-labs/clawdstrikeReview coming soon (opens GitHub in a new tab)Defense and hardening / Incident response / Threat intelligence2992026-10-22 Not ratedowlsmcybereason-public/owlsmReview coming soon (opens GitHub in a new tab)Incident response2812026-10-22 Not ratedsecurityclawsecurityclaw/securityclawReview coming soon (opens GitHub in a new tab)Incident response2772026-10-19 Not ratedmalwlessn0dec/malwlessReview coming soon (opens GitHub in a new tab)Incident response / Defense and hardening2712024-05-02 Not ratedmicrosoft-sentinel-secopseshlomo1/microsoft-sentinel-secopsReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence2702026-07-24 Not ratedcollect-memorydumplethal-forensics/collect-memorydumpReview coming soon (opens GitHub in a new tab)Incident response2702025-10-29 Not ratedfastfindercodeyourweb/fastfinderReview coming soon (opens GitHub in a new tab)Incident response2612026-01-24 Not ratedthreat-huntingsapphirex00/threat-huntingReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response2612019-02-07 Not ratedepagneuljurelou/epagneulReview coming soon (opens GitHub in a new tab)Forensics / Incident response2532025-01-15 Not ratedsigma-rulesjoesecurity/sigma-rulesReview coming soon (opens GitHub in a new tab)Incident response2452024-11-04 Not ratedphishingkithuntert4d/phishingkithunterReview coming soon (opens GitHub in a new tab)Incident response / Red teaming and C2 / Threat intelligence2432019-01-21 Not ratedadamarandomuserid/adamaReview coming soon (opens GitHub in a new tab)Incident response2382025-03-26 Not ratedravenqeeqbox/ravenReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence2352023-08-08 Not ratedgit-alertsboringtools/git-alertsReview coming soon (opens GitHub in a new tab)Incident response2322026-08-25 Not ratedhayabusa-rulesyamato-security/hayabusa-rulesReview coming soon (opens GitHub in a new tab)Incident response / Forensics2292026-10-21 Not ratedcrowdstrike-falcon-queriespe3zx/crowdstrike-falcon-queriesReview coming soon (opens GitHub in a new tab)Incident response2212020-05-23 Not ratedhacksguardrhacknarok/hacksguardReview coming soon (opens GitHub in a new tab)Malware analysis / Incident response2152026-10-11 Not rateddetectraptormgreen27/detectraptorReview coming soon (opens GitHub in a new tab)Incident response2092026-10-18 Not ratedpurpleteammthcht/purpleteamReview coming soon (opens GitHub in a new tab)Incident response / Threat intelligence2062024-12-20 Not ratedwefflesjepaynemsft/wefflesReview coming soon (opens GitHub in a new tab)Incident response2022017-12-11 Not rateddetectwindowscopyonwriteforapinccgroup/detectwindowscopyonwriteforapiReview coming soon (opens GitHub in a new tab)Incident response1982022-01-13 Not ratedblauhauntcgosec/blauhauntReview coming soon (opens GitHub in a new tab)Incident response1882026-08-18 Not rateddfir_resources_revil_kaseyacado-security/dfir_resources_revil_kaseyaReview coming soon (opens GitHub in a new tab)Incident response / Forensics1852021-07-06 Not ratedioc-finderfhightower/ioc-finderReview coming soon (opens GitHub in a new tab)Threat intelligence / Malware analysis / Incident response1842026-10-22 Not ratedhunting-rulestravisbgreen/hunting-rulesReview coming soon (opens GitHub in a new tab)Network / Incident response / Red teaming and C21842026-05-07 Not ratedpatrowlhearspatrowl/patrowlhearsReview coming soon (opens GitHub in a new tab)Exploits and PoCs / Incident response / Threat intelligence1682026-03-14 Not ratedsigma-rulesmbabinski/sigma-rulesReview coming soon (opens GitHub in a new tab)Incident response1672025-11-25 Not ratedawesome-cybersecurityannsec/awesome-cybersecurityReview coming soon (opens GitHub in a new tab)Learning and practice labs / Incident response1602026-10-07 Not ratedbluecloudiknowjason/bluecloudReview coming soon (opens GitHub in a new tab)Incident response1522022-11-02 Not ratedsubcrawlhpthreatresearch/subcrawlReview coming soon (opens GitHub in a new tab)Threat intelligence / Incident response1512023-09-22 Not ratedafltriagequalcomm/afltriageReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Incident response1502026-07-28 Not ratedawesome-wazuhttlab-research/awesome-wazuhReview coming soon (opens GitHub in a new tab)Incident response1472026-07-21 Not ratedunifiedthreathuntingsims718718/unifiedthreathuntingReview coming soon (opens GitHub in a new tab)Incident response1462026-10-02 Not ratedthreat_huntingt3l3m3try/threat_huntingReview coming soon (opens GitHub in a new tab)Incident response1332022-05-13 Not ratedsigma_rulestsale/sigma_rulesReview coming soon (opens GitHub in a new tab)Incident response1262025-01-29 Not ratedcrawlectormfmokbel/crawlectorReview coming soon (opens GitHub in a new tab)Incident response1232025-12-13 Not ratedallthingstimesketchblueteam0ps/allthingstimesketchReview coming soon (opens GitHub in a new tab)Incident response1222023-10-08 Not ratedhoneywireandreicscs/honeywireReview coming soon (opens GitHub in a new tab)Defense and hardening / Containers and cloud / Incident response1122026-08-28 Not ratedultrafuzzmonad-developers/ultrafuzzReview coming soon (opens GitHub in a new tab)Incident response / AppSec and DevSecOps1082026-10-16 Not ratedmediatorlawndoc/mediatorReview coming soon (opens GitHub in a new tab)Incident response1002025-09-28