zentral by zentralopensource

Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.

created at Oct. 20, 2015, 2:03 p.m.

Python

31 +0

722 +0

83 +0

GitHub
Fastir_Collector by SekoiaLab

None

created at Oct. 23, 2015, 9:18 a.m.

Python

63 +0

503 +1

127 +0

GitHub
cuckoo-modified by spender-sandbox

Modified edition of cuckoo

created at Nov. 30, 2015, 1:55 p.m.

Python

72 +0

389 +0

178 +0

GitHub
CDQR by orlikoski

The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted drives and extracted artifacts from Windows, Linux, MacOS, and Android devices

created at Jan. 14, 2016, 4:48 p.m.

Python

30 +0

328 +0

51 +0

GitHub
Fastir_Collector_Linux by SekoiaLab

None

created at Jan. 25, 2016, 2:10 p.m.

Python

23 +0

166 +0

43 +0

GitHub
doorman by mwielgoszewski

an osquery fleet manager

created at April 22, 2016, 7:31 p.m.

Python

33 +0

616 +0

95 +0

GitHub
dftimewolf by log2timeline

A framework for orchestrating forensic collection, processing and data export

created at July 29, 2016, 1:54 p.m.

Python

25 +0

278 +0

69 +0

GitHub
margaritashotgun by ThreatResponse

Remote Memory Acquisition Tool

created at Aug. 9, 2016, 5:39 p.m.

Python

17 +0

235 +0

50 +0

GitHub
hostintel by keithjjones

A modular Python application to collect intelligence for malicious hosts.

created at Aug. 22, 2016, 8:25 p.m.

Python

30 +0

258 +0

52 +0

GitHub
fileintel by keithjjones

A modular Python application to pull intelligence about malicious files

created at Aug. 30, 2016, 5:35 p.m.

Python

17 +0

114 +0

25 +0

GitHub
Panorama by AlmCo

Fast incident overview

created at Sept. 12, 2016, 8:35 p.m.

Python

3 +0

38 +0

6 +0

GitHub
cuckoo-modified-api by keithjjones

A Python library to interface with a cuckoo-modified instance

created at Sept. 25, 2016, 4:15 p.m.

Python

6 +0

19 +0

7 +0

GitHub
sigma by SigmaHQ

Main Sigma Rule Repository

created at Dec. 24, 2016, 9:48 a.m.

Python

328 +1

7,723 +23

2,103 +0

GitHub
streamalert by airbnb

StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.

created at Jan. 22, 2017, 1:10 a.m.

Python

101 +0

2,825 +0

334 +0

GitHub
logdissect by dogoncouch

CLI utility and Python module for analyzing log files and other data.

created at Feb. 19, 2017, 8:31 p.m.

Python

11 +0

138 +0

22 +0

GitHub
ThreatHunter-Playbook by OTRF

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

created at March 28, 2017, 3:07 a.m.

Python

369 -1

3,884 +7

796 +0

GitHub
appcompatprocessor by mbevilacqua

"Evolving AppCompat/AmCache data analysis beyond grep"

created at April 2, 2017, 6:11 p.m.

Python

17 +0

190 +0

26 +0

GitHub
sqhunter by 0x4D31

A simple threat hunting tool based on osquery, Salt Open and Cymon API

created at June 23, 2017, 8:59 a.m.

Python

12 +0

65 +0

15 +0

GitHub
mac_apt by ydkhatri

macOS (& ios) Artifact Parsing Tool

created at Aug. 24, 2017, 3:37 p.m.

Python

44 +0

719 +0

99 +0

GitHub
AutoTTP by jymcheong

Automated Tactics Techniques & Procedures

created at Sept. 7, 2017, 6:25 a.m.

Python

24 +0

244 +0

64 +0

GitHub