ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework
☆188Oct 29, 2026Updated this week
Alternatives and similar repositories for ALFA
Users that are interested in ALFA are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Public script from SANS FOR509 Enterprise Cloud Incident Response☆242Oct 26, 2025Updated last year
- A tool for AWS incident response, that allows for enumeration, acquisition and analysis of data from AWS environments for the purpose of …☆207Aug 11, 2026Updated 2 months ago
- A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.☆864Jun 29, 2026Updated 4 months ago
- Parses USB connection artifacts from offline Registry hives☆109Feb 8, 2026Updated 8 months ago
- Notes on responding to security breaches relating to Azure AD☆130Mar 14, 2022Updated 4 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"☆11Feb 6, 2025Updated last year
- A cheatsheet containing AWS CloudTrail events that can be used for Incident Response purposes or Detection Engineering.☆86Jan 6, 2026Updated 9 months ago
- Repository of attack and defensive information for Business Email Compromise investigations☆282Jun 17, 2026Updated 4 months ago
- The Business Email Compromise Guide sets out to describe 10 steps for performing a Business Email Compromise (BEC) investigation in an Of…☆282Feb 2, 2021Updated 5 years ago
- PowerShell module for Office 365 and Azure log collection☆284Sep 22, 2025Updated last year
- Volatile Artifact Collector collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of par…☆254Nov 18, 2024Updated last year
- Cumulonimbus-UAL_Extractor is a PowerShell based tool created by the Tesorion CERT team to help gather the Unified Audit Logging out of a…☆21Oct 25, 2023Updated 3 years ago
- Extract BITS jobs from QMGR queue and store them as CSV records☆74Feb 13, 2025Updated last year
- ESXi Cyber Security Incident Response Script☆29Sep 4, 2024Updated 2 years ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID☆684Oct 26, 2026Updated last week
- DeRF (Detection Replay Framework) is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation o…☆100Jan 12, 2024Updated 2 years ago
- ☆75Oct 21, 2024Updated 2 years ago
- This tool aims at parsing Microsoft Protection logs to provide relevant data to forensic analysts during incident responses.☆22Sep 30, 2022Updated 4 years ago
- Aftermath is a free macOS IR framework☆602Sep 25, 2025Updated last year
- USN Journal full path builder☆71Apr 16, 2026Updated 6 months ago
- Powershell module for VMWare vSphere forensics☆189Nov 8, 2024Updated last year
- Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.☆235Oct 27, 2026Updated last week
- Stand-alone parser for User Access Logging from Server 2012 and newer systems☆79Jan 9, 2024Updated 2 years ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆743Aug 31, 2026Updated 2 months ago
- Forensic cheatsheets for use with cheat☆16Dec 2, 2021Updated 4 years ago
- A dataset containing Office 365 Unified Audit Logs for security research and detection☆67Aug 12, 2026Updated 2 months ago
- Convert cloudtrail data to MITRE ATT&CK Sightings☆84Jul 25, 2022Updated 4 years ago
- ☆77Mar 19, 2025Updated last year
- ☆24Mar 12, 2025Updated last year
- Scripts to for ready-to-use Velociraptor instance deployment in Azure☆14Jun 27, 2023Updated 3 years ago
- Forensic Artifact Collection Tool for macOS☆121Jul 28, 2025Updated last year
- Powershell Based tool for gathering information related to O365 intrusions and potential Breaches☆960Jun 10, 2026Updated 4 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.☆120Jan 26, 2022Updated 4 years ago
- CyLR - Live Response Collection Tool☆737Jun 1, 2022Updated 4 years ago
- Quick ESXi Log Parser☆33Jul 21, 2026Updated 3 months ago
- ☆152Jun 5, 2024Updated 2 years ago
- Powering Up Incident Response with Power-Response☆63Mar 5, 2020Updated 6 years ago
- A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as …☆475Feb 18, 2026Updated 8 months ago
- DFIQ is a collection of investigative questions and the approaches for answering them☆318Mar 10, 2026Updated 7 months ago