Alternatives and similar repositories for SANS-DFIR-2017

Users that are interested in SANS-DFIR-2017 are comparing it to the libraries listed below

• csirtgadgets / verbose-robot
  The Fastest way to consume Threat Intel
  ☆26Updated 3 years ago
• JustinAzoff / passive-dns
  dns logger for passive dns collection
  ☆42Updated 13 years ago
• jaegeral / awesome-cyber-civil-society-actors
  A curated lust of awesome cyber civil society actors, project etc.
  ☆10Updated 5 years ago
• dougiep16 / actortrackr
  Home to the ActorTrackr source code
  ☆24Updated 8 years ago
• obsidianforensics / scripts
  Small scripts and POCs related to digital forensics
  ☆18Updated 2 years ago
• egaus / malicious_url_analysis
  ☆18Updated 7 years ago
• clong / vagrant-ids
  An Ubuntu 16.04 build containing Suricata, PulledPork, Bro, and Splunk
  ☆23Updated 7 years ago
• zeroq / kraut_salad
  Proof of concept implementation of a cyber threat intelligence and incident handling platform
  ☆11Updated 2 years ago
• MISP / intelligence-icons
  intelligence-icons is a collection of icons and diagrams for building training and marketing materials around Intelligence sharing; inclu…
  ☆41Updated 6 years ago
• notx11 / urlScan2Hive
  Triage automation for suspect URLs
  ☆13Updated 6 years ago
• CIRCL / traceroute-circl
  Traceroute improved wrapper for CSIRT and CERT operators
  ☆38Updated 10 months ago
• gcrahay / otx_misp
  Imports Alienvault OTX pulses to a MISP instance
  ☆53Updated 3 years ago
• yeti-platform / pyeti
  Python bindings for Yeti's API
  ☆18Updated last year
• maltiverse / python-maltiverse
  API wrapper for Maltiverse
  ☆19Updated 11 months ago
• active-threat-hunting / active-threat-hunting
  Tools for hunting security threats
  ☆12Updated 5 years ago
• cmatthewbrooks / pyiocutils
  A collection of Python utilities for use in scripts related to working with "indicators of compromise" (IOCs).
  ☆17Updated 6 years ago
• spitfire55 / MegaDev
  Bro IDS + ELK Stack to detect and block data exfiltration
  ☆46Updated 6 years ago
• Concinnity-Risks / RansomCoinPublic
  A DFIR tool to extract cryptocoin addresses and other indicators of compromise from binaries.
  ☆56Updated last year
• PaulSec / Shodan-mattermost
  Mattermost - Shodan Slash command
  ☆31Updated 8 years ago
• MISP / mail_to_misp
  Connect your mail client/infrastructure to MISP in order to create events based on the information contained within mails.
  ☆69Updated last year
• hosom / bro-otx
  Integrate Zeek with Alienvault OTX
  ☆25Updated 4 years ago
• pwnlandia / hpfeeds-logger
  Small App for reading from MHN's hpfeeds broker and writing splunk logs
  ☆10Updated 5 years ago
• MISP / misp-vagrant
  Deploy MISP Project software with Vagrant.
  ☆44Updated 5 years ago
• cudeso / tools
  Different tools, koen.vanimpe@cudeso.be
  ☆136Updated last month
• alias454 / graylog-zeek-content-pack
  BRO/Zeek IDS content pack contains pipeline rules, a stream, a dashboard displaying interesting activity, and a syslog tcp input to captu…
  ☆19Updated 5 years ago
• weslambert / securityonion-strelka
  ☆13Updated 5 years ago
• JacobPimental / gunslinger
  Gunslinger is used to hunt for Magecart sites using URLScan's API
  ☆31Updated 3 years ago
• diogo-fernan / domfind
  A Python DNS crawler to find identical domain names under different TLDs.
  ☆25Updated 6 years ago
• 411Hall / obscurer
  Cowrie Honeypot Obscurer
  ☆17Updated 4 years ago
• jaegeral / osint_to_timesketch
  Virustotal Data to Timesketch
  ☆17Updated 6 years ago