logdissect by dogoncouch
CLI utility and Python module for analyzing log files and other data.
created at Feb. 19, 2017, 8:31 p.m.
zentral by zentralopensource
Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.
created at Oct. 20, 2015, 2:03 p.m.
CIRTKit by opensourcesec
Tools for the Computer Incident Response Team 
created at Oct. 19, 2015, 3:50 p.m.
metta by uber-common
An information security preparedness tool to do adversarial simulation.
created at Nov. 1, 2017, 9:24 p.m.
diffy by Netflix-Skunkworks
(DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.
created at May 1, 2018, 10:11 p.m.
margaritashotgun by ThreatResponse
Remote Memory Acquisition Tool
created at Aug. 9, 2016, 5:39 p.m.
pyarascanner by nogoodconfig
A simple many-rules to many-files YARA scanner for incident response or malware zoos.
created at May 3, 2018, 11:49 a.m.
streamalert by airbnb
StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
created at Jan. 22, 2017, 1:10 a.m.
MalConfScan by JPCERTCC
Volatility plugin for extracts configuration data of known malware
created at April 22, 2019, 12:23 a.m.
appcompatprocessor by mbevilacqua
"Evolving AppCompat/AmCache data analysis beyond grep"
created at April 2, 2017, 6:11 p.m.