Alternatives and similar repositories for SANS-DFIR-2017

Users that are interested in SANS-DFIR-2017 are comparing it to the libraries listed below

• 411Hall / obscurer
  Cowrie Honeypot Obscurer
  ☆17Updated 5 years ago
• csirtgadgets / verbose-robot
  The Fastest way to consume Threat Intel
  ☆26Updated 3 years ago
• active-threat-hunting / active-threat-hunting
  Tools for hunting security threats
  ☆12Updated 5 years ago
• obsidianforensics / scripts
  Small scripts and POCs related to digital forensics
  ☆18Updated 3 years ago
• jaegeral / awesome-cyber-civil-society-actors
  A curated lust of awesome cyber civil society actors, project etc.
  ☆10Updated 5 years ago
• 3c7 / common-osint-model
  Converting data from services like Censys and Shodan to a common data model
  ☆50Updated 2 weeks ago
• cmatthewbrooks / pyiocutils
  A collection of Python utilities for use in scripts related to working with "indicators of compromise" (IOCs).
  ☆16Updated 7 years ago
• AlienVault-OTX / ThreatCrowd-Maltego
  Maltego transforms for the ThreatCrowd search API
  ☆47Updated 7 years ago
• jalewis / actortrackr
  Home to the ActorTrackr source code
  ☆30Updated 8 years ago
• CIRCL / PyPDNS
  Client API to query any Passive DNS implementation following the Passive DNS - Common Output Format.
  ☆81Updated 2 weeks ago
• yeti-platform / pyeti
  Python bindings for Yeti's API
  ☆19Updated 2 years ago
• jaegeral / osint_to_timesketch
  Virustotal Data to Timesketch
  ☆16Updated 6 years ago
• treyka / threaty_threatego
  Maltego entity pack encompassing the entire STIX 1.2 data model and a targeted subset of the CybOX 2.1 data model
  ☆11Updated 9 years ago
• cocaman / yara-scan-service
  Repository for scripts and tips for "Yara Scan Service"
  ☆20Updated 2 years ago
• ioc-fang / ioc-fanger
  Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .
  ☆68Updated 2 years ago
• Concinnity-Risks / LogisticalBudget
  This project contains code for comparing or ranking APT capabilities and operational capacity. The metrics are meant to quantify, rank, o…
  ☆35Updated 6 years ago
• daveherrald / scansio-sonar-splunk
  Python scripts to download, parse, and enrich scans.io study data and load into Splunk for research, threat intelligence gathering, and s…
  ☆19Updated 2 weeks ago
• WebBreacher / emailwhois
  Look up an email domain (@example.com), using Python, across all known domains.
  ☆46Updated 2 years ago
• MISP / mail_to_misp
  Connect your mail client/infrastructure to MISP in order to create events based on the information contained within mails.
  ☆69Updated 2 years ago
• egaus / malicious_url_analysis
  ☆18Updated 7 years ago
• notx11 / urlScan2Hive
  Triage automation for suspect URLs
  ☆13Updated 6 years ago
• clong / vagrant-ids
  An Ubuntu 16.04 build containing Suricata, PulledPork, Bro, and Splunk
  ☆23Updated 7 years ago
• Te-k / commands-for-sec
  Useful commands for infosec
  ☆28Updated 2 years ago
• triw0lf / urlscan_scripts
  A bunch of scripts I use to work with urlscan.io
  ☆35Updated 6 years ago
• pwnlandia / hpfeeds-logger
  Small App for reading from MHN's hpfeeds broker and writing splunk logs
  ☆10Updated 6 years ago
• philhagen / ip2geo
  Script to perform bulk local GeoIP lookups (ASN and geo) for IP addresses
  ☆102Updated 6 years ago
• gcrahay / otx_misp
  Imports Alienvault OTX pulses to a MISP instance
  ☆53Updated 4 years ago
• dougiep16 / actortrackr
  Home to the ActorTrackr source code
  ☆24Updated 8 years ago
• markedoe / cuckoo-sandbox
  cuckoo sandbox patches and scripts
  ☆15Updated 11 years ago
• ecstatic-nobel / Analyst-Arsenal
  A toolkit for Security Researchers
  ☆127Updated 6 years ago