Alternatives and similar repositories for SANS-DFIR-2017

Users that are interested in SANS-DFIR-2017 are comparing it to the libraries listed below

• notx11 / urlScan2Hive
  Triage automation for suspect URLs
  ☆13Updated 6 years ago
• jaegeral / osint_to_timesketch
  Virustotal Data to Timesketch
  ☆16Updated 6 years ago
• weslambert / securityonion-strelka
  ☆13Updated 6 years ago
• gcrahay / otx_misp
  Imports Alienvault OTX pulses to a MISP instance
  ☆53Updated 4 years ago
• MISP / intelligence-icons
  intelligence-icons is a collection of icons and diagrams for building training and marketing materials around Intelligence sharing; inclu…
  ☆41Updated 6 years ago
• 3c7 / common-osint-model
  Converting data from services like Censys and Shodan to a common data model
  ☆50Updated last month
• cudeso / tools
  Different tools, koen.vanimpe@cudeso.be
  ☆136Updated 5 months ago
• JustinAzoff / passive-dns
  dns logger for passive dns collection
  ☆42Updated 13 years ago
• thomaspatzke / sigma-workshop
  Elasticsearch/Kibana environment and log data for Sigma workshop
  ☆27Updated 6 years ago
• MISP / misp-vagrant
  Deploy MISP Project software with Vagrant.
  ☆45Updated 5 years ago
• yeti-platform / pyeti
  Python bindings for Yeti's API
  ☆19Updated 2 years ago
• active-threat-hunting / active-threat-hunting
  Tools for hunting security threats
  ☆12Updated 5 years ago
• MISP / mail_to_misp
  Connect your mail client/infrastructure to MISP in order to create events based on the information contained within mails.
  ☆69Updated 2 years ago
• cmatthewbrooks / pyiocutils
  A collection of Python utilities for use in scripts related to working with "indicators of compromise" (IOCs).
  ☆16Updated 7 years ago
• 0x4D31 / awesome-honeypots
  an awesome list of honeypot resources
  ☆10Updated 8 years ago
• fireeye / brocapi
  Bro PCAP Processing and Tagging API
  ☆28Updated 8 years ago
• alias454 / graylog-zeek-content-pack
  BRO/Zeek IDS content pack contains pipeline rules, a stream, a dashboard displaying interesting activity, and a syslog tcp input to captu…
  ☆19Updated 5 years ago
• obsidianforensics / scripts
  Small scripts and POCs related to digital forensics
  ☆18Updated 3 years ago
• hxnoyd / ossem-power-up
  A tool to assess data quality, built on top of the awesome OSSEM.
  ☆79Updated 3 years ago
• CIRCL / traceroute-circl
  Traceroute improved wrapper for CSIRT and CERT operators
  ☆39Updated last year
• cocaman / yara-scan-service
  Repository for scripts and tips for "Yara Scan Service"
  ☆20Updated 2 years ago
• spitfire55 / MegaDev
  Bro IDS + ELK Stack to detect and block data exfiltration
  ☆46Updated 7 years ago
• uforia / exitgather
  Tool for automatic list generation of known TOR and VPN exit nodes
  ☆29Updated 2 years ago
• counteractive / incident-response-collector
  ☆17Updated 5 years ago
• op7ic / amphunt
  This repository contains advanced threat hunting scripts for Cisco Secure Endpoint API. The scripts leverage the AMP API to hunt for thre…
  ☆14Updated 6 months ago
• Silv3rHorn / autoripy
  Attempt to replicate the functions of auto_rip by Corey Harrell in Python.
  ☆12Updated last year
• NextronSystems / thor_attck
  THOR MITRE ATT&CK Framework Coverage
  ☆25Updated 5 years ago
• DearBytes / Opensource-Endpoint-Monitoring
  This repository contains all the config files and scripts used for our Open Source Endpoint monitoring project.
  ☆35Updated 6 years ago
• Concinnity-Risks / LogisticalBudget
  This project contains code for comparing or ranking APT capabilities and operational capacity. The metrics are meant to quantify, rank, o…
  ☆35Updated 6 years ago
• capesstack / capes-docker
  Cyber Analytics Platform and Examination System (CAPES) Project Page
  ☆14Updated 3 years ago