DFIR forensics companion server + capture extension
☆36Nov 8, 2026Updated this week
Alternatives and similar repositories for DFIR-Companion
Users that are interested in DFIR-Companion are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Disk Image Mounting Script☆14Jul 21, 2026Updated 3 months ago
- A unified investigation cockpit built for CSIRT / SOC / DFIR teams. Ingest, correlate and visualise any forensic source in a real-time in…☆46Updated this week
- A lightning-fast, lightweight DFIR triage and threat hunting engine for Windows Minidumps (.DMP).☆20Oct 2, 2026Updated last month
- Ungraded practice exercises for python scripting for security course.☆12Jun 22, 2025Updated last year
- Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard☆20Updated this week
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Rust DFIR tool that massively parses cross-platform evidence, even deleted logs, into a lateral movement timeline and graph database.☆33Updated this week
- Autonomous DFIR agent — SANS SIFT Workstation MCP server for incident response☆69Oct 30, 2026Updated last week
- A 'code-mode' MCP server that allows LLMs to safely generate and execute JavaScript code that performs forensic analysis and employs trad…☆41Updated this week
- Valhuntir CLI — AI-augmented incident response platform☆149Updated this week
- Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Pyth…☆28Updated this week
- Windows Forensics Salt States☆23Updated this week
- Windows EVTX log analysis for DFIR — fast parsing, ATT&CK mapping, IOC extraction, and Sentinel anomaly detection. Normal + Juggernaut Mo…☆61Updated this week
- Linux Persistence Detection, Hunting and Artifact Collection script☆30Oct 31, 2026Updated last week
- Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulat…☆35Oct 20, 2026Updated 3 weeks ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Synapse Rapid Power-up for SinkDB☆11Jun 24, 2025Updated last year
- Volatility 3 ported to Rust. Same output, much faster.☆199Oct 6, 2026Updated last month
- A self-verifying autonomous DFIR analyst: read-only MCP forensic tools plus an adversarial Investigator/Skeptic self-correction loop.☆28Jun 10, 2026Updated 5 months ago
- Script that uses exiftool and c2pa to identify metadata tags that indicate AI generation☆15Dec 27, 2025Updated 10 months ago
- ☆25Mar 12, 2025Updated last year
- Convert MISP events to Elastalert rules☆12Aug 10, 2021Updated 5 years ago
- CryptnetURLCacheParser is a tool to parse CryptAPI cache files☆24Aug 3, 2024Updated 2 years ago
- a-ray-grass is a yara module that provides support for DCSO-format bloom filters in yara. In the context of hashlookup, it allows quickly…☆14Aug 19, 2022Updated 4 years ago
- A Compiler from Sigma rules to VQL☆21Oct 19, 2026Updated 3 weeks ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- This project is an AI-powered Security Information and Event Management (SIEM) system designed for real-time threat detection and respons…☆10Jun 3, 2025Updated last year
- Script to decode Fortinet binary firewall logs.☆13Dec 12, 2025Updated 10 months ago
- MacOS forensic collector for Velociraptor. 70 artefacts covering browsers, communications, user activity, persistence, security, logs, fi…☆17May 26, 2026Updated 5 months ago
- Self-hosted threat intelligence platform — feed aggregation, AI triage, MITRE ATT&CK coverage, and Sentinel-integrated detection engineer…☆60Oct 15, 2026Updated 3 weeks ago
- An AI agent skill that can be used to create queries in the CrowdStrike Query Language.☆16Apr 14, 2026Updated 6 months ago
- $I30 INDX Carver☆18Jun 23, 2025Updated last year
- TheHiveIRPlaybook is a collection of TheHive case templates used for Incident Response☆13Jul 13, 2020Updated 6 years ago
- ☆13Jan 26, 2026Updated 9 months ago
- Invoke-Forensics provides PowerShell commands to simplify working with the forensic tools KAPE and RegRipper.☆119Nov 28, 2023Updated 2 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- This project automates the creation of a complete security lab environment for detection engineering and attack simulation.☆14Aug 8, 2025Updated last year
- Publicly shareable windows event log message data☆29Nov 29, 2019Updated 6 years ago
- A curated reference of threat detection engineering & incident response frameworks, tools, and detection rule sources.☆13Jun 30, 2026Updated 4 months ago
- Volume Shadow Copy Explorer☆18Nov 23, 2025Updated 11 months ago
- Setup and authentication skills for CrowdStrike MCP: streamlined connection configuration, OAuth 2.0 token management, and secure access …☆14Aug 27, 2026Updated 2 months ago
- MemGuard v2.0 (by @prox0959) - Zero-dependency Windows EDR utility: NT kernel handle table auditor, NTDLL syscall hook detector & credent…☆18Oct 24, 2026Updated 2 weeks ago
- Browse Windows Recycle Bin from E01 forensic images with Explorer-style interface. Parse $I/$R artifacts, view deleted files in original …☆18Dec 16, 2025Updated 10 months ago
Are these results useful?