Alternatives and similar repositories for Falcon-Toolkit:

Users that are interested in Falcon-Toolkit are comparing it to the libraries listed below

• SophosRapidResponse / OSQuery
  ☆83Updated last month
• CrowdStrike / caracara
  Developer enhancements (DX) for FalconPy, the CrowdStrike Python SDK
  ☆39Updated this week
• keyboardcrunch / sentinelone-queries
  Repository of SentinelOne Deep Visibility queries.
  ☆122Updated 3 years ago
• keyboardcrunch / SentinelOne-Query-Navigator
  Web based S1 query navigator for one-click threat hunting
  ☆18Updated 4 years ago
• Silv3rHorn / BulkStrike
  BulkStrike enables the usage of CrowdStrike Real Time Response (RTR) to bulk execute commands on multiple machines.
  ☆42Updated 2 years ago
• tuckner / automation-capability-matrix
  A tool that allows you to document and assess any security automation in your SOC
  ☆45Updated 3 months ago
• bk-cs / rtr
  Real-time Response scripts and schema
  ☆110Updated last year
• pfpt-andrew / Rapid-Response-Reporting
  RRR (Rapid Response Reporting) is a collection of Incident Response Report objects. They are designed to help incident responders provid…
  ☆36Updated 2 years ago
• thinkst / canary-utils
  Collection of useful Canary tools
  ☆75Updated this week
• k-bailey / detection-engineering-maturity-matrix
  ☆93Updated 2 years ago
• SentineLabs / S1QL-Queries
  ☆57Updated last year
• rapid7 / insightvm-sql-queries
  InsightVM helpful SQL queries
  ☆64Updated this week
• msraju / Incident-Response-Playbooks
  ☆42Updated 2 years ago
• secure-cake / rapid-endpoint-investigations
  Scripts for rapid Windows endpoint "tactical triage" and investigations with Velociraptor and KAPE
  ☆110Updated last month
• invictus-ir / ALFA
  ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit l…
  ☆156Updated this week
• olafhartong / MDE-AuditCheck
  MDE relies on some of the Audit settings to be enabled
  ☆97Updated 2 years ago
• invictus-ir / Blue-team-app-Office-365-and-Azure
  ☆72Updated 4 months ago
• freeload101 / CrowdStrike_RTR_Powershell_Scripts
  ☆68Updated 11 months ago
• cudeso / misp2sentinel
  MISP to Sentinel integration
  ☆62Updated 2 months ago
• duosecurity / duo_log_sync
  ☆38Updated this week
• CrowdStrike / MISP-tools
  Import CrowdStrike Threat Intelligence into your instance of MISP
  ☆43Updated 4 months ago
• 0x706972686f / RMM-Catalogue
  ☆79Updated 2 weeks ago
• ReconInfoSec / velociraptor-to-timesketch
  ☆5Updated 3 months ago
• malwarejake-public / conference-presentations
  Conference presentations
  ☆47Updated last year
• blackhillsinfosec / audit-inspector
  Audit Inspector is a tool for configuring and auditing Windows auditing.
  ☆32Updated 4 months ago
• strozfriedberg / greppin-logs
  2021 SANS DFIR Summit: Greppin' Logs
  ☆21Updated 3 years ago
• blueteamvillage / Project-Obsidian-DC30
  ☆41Updated 9 months ago
• mgreen27 / DetectRaptor
  A repository to share publicly available Velociraptor detection content
  ☆126Updated this week
• socprime / the-prime-hunt
  A browser extension for threat hunting that provides one UI for different SIEMs/EDRs and simplifies investigation
  ☆76Updated 9 months ago
• PolarBearGod / CrowdStrike-RTR-Scripts
  ☆26Updated 3 years ago