ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework
☆183Aug 31, 2026Updated this week
Alternatives and similar repositories for ALFA
Users that are interested in ALFA are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Public script from SANS FOR509 Enterprise Cloud Incident Response☆239Oct 26, 2025Updated 10 months ago
- A tool for AWS incident response, that allows for enumeration, acquisition and analysis of data from AWS environments for the purpose of …☆205Aug 11, 2026Updated 3 weeks ago
- A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.☆839Jun 29, 2026Updated 2 months ago
- Parses USB connection artifacts from offline Registry hives☆110Feb 8, 2026Updated 6 months ago
- Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"☆11Feb 6, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.☆86Jan 6, 2026Updated 7 months ago
- This repository contains the research and components of our research into using Sigma for AWS Incident Response.☆35Jul 12, 2023Updated 3 years ago
- ☆73Oct 21, 2024Updated last year
- Notes on responding to security breaches relating to Azure AD☆125Mar 14, 2022Updated 4 years ago
- The Business Email Compromise Guide sets out to describe 10 steps for performing a Business Email Compromise (BEC) investigation in an Of…☆281Feb 2, 2021Updated 5 years ago
- Repository of attack and defensive information for Business Email Compromise investigations☆279Jun 17, 2026Updated 2 months ago
- A dataset containing Office 365 Unified Audit Logs for security research and detection☆64Aug 12, 2026Updated 3 weeks ago
- PowerShell module for Office 365 and Azure log collection☆282Sep 22, 2025Updated 11 months ago
- Forensic cheatsheets for use with cheat☆15Dec 2, 2021Updated 4 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of par…☆254Nov 18, 2024Updated last year
- Extract BITS jobs from QMGR queue and store them as CSV records☆74Feb 13, 2025Updated last year
- DeRF (Detection Replay Framework) is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation o…☆100Jan 12, 2024Updated 2 years ago
- USN Journal full path builder☆71Apr 16, 2026Updated 4 months ago
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Jun 27, 2023Updated 3 years ago
- Powershell module for VMWare vSphere forensics☆185Nov 8, 2024Updated last year
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆221Updated this week
- A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID☆679Jul 6, 2026Updated last month
- Aftermath is a free macOS IR framework☆595Sep 25, 2025Updated 11 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Stand-alone parser for User Access Logging from Server 2012 and newer systems☆80Jan 9, 2024Updated 2 years ago
- Cumulonimbus-UAL_Extractor is a PowerShell based tool created by the Tesorion CERT team to help gather the Unified Audit Logging out of a…☆21Oct 25, 2023Updated 2 years ago
- ESXi Cyber Security Incident Response Script☆28Sep 4, 2024Updated 2 years ago
- DFIQ is a collection of investigative questions and the approaches for answering them☆313Mar 10, 2026Updated 5 months ago
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆735Updated this week
- ☆152Jun 5, 2024Updated 2 years ago
- ☆76Mar 19, 2025Updated last year
- ☆23Mar 12, 2025Updated last year
- Rhaegal is a tool written in Python 3 used to scan Windows Event Logs for suspicious logs. Rhaegal uses custom rule format to detect sus…☆43Sep 21, 2023Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- ☆27Mar 2, 2022Updated 4 years ago
- CyLR - Live Response Collection Tool☆734Jun 1, 2022Updated 4 years ago
- A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs☆850Aug 24, 2026Updated last week
- This tool aims at parsing Microsoft Protection logs to provide relevant data to forensic analysts during incident responses.☆22Sep 30, 2022Updated 3 years ago
- UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It …☆1,442Updated this week
- Tool to extract Sessions, MessageID(s) and find the emails belonging to MessageID(s). This script utilizes the MailItemsAccessed features…☆43Oct 20, 2020Updated 5 years ago
- Project based on RegRipper, to extract add'l value/pivot points from TLN events file☆89Feb 9, 2025Updated last year