A knowledge base of actionable Incident Response techniques
amittdfirincident-responsemitre-attackresponse-playbooksthehive
Source: GitHub repository metadata.
Repository search
Find public projects in our local index, with related guides and tools from MetaCyberGuru. Your search is not sent to GitHub.
Explore topic collections for selection checklists and useful search examples.
265 matching repositories.
5,477 indexed in total. Latest successful discovery check: 2026-11-08 09:40:22 UTC.
Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM.
ai-agentai-forensicscybersecuritydfirdigital-forensicsforensicsincident-responsellm-agent
Source: GitHub repository metadata.
GOAL: Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques. [Contributors Friendly]
catalogcontributions-welcomecontributors-welcomecybersecuritycybersecurity-playbookincident-managementincident-responseincidents
Source: GitHub repository metadata.
Avilla Forensics FREE
adbadb-commandsandroidapktooldevicesdigital-forensicsdowngradedowngrade-attack
Source: GitHub repository metadata.
This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services.
awsincident-responseplaybooks
Source: GitHub repository metadata.
A library of Incident Response notebooks using Jupyter. We will show how you can leverage pre-defined notebook files to guide your incident responders in identifying, containing, eradicating, and recovering from an incident.
automationdocumentationincident-responsejupyter-notebook
Source: GitHub repository metadata.
Open-source tools for AWS DevOps Agent - extend DevOps Agent with ready-to-use skills, custom agents, and other tools, for incident response, root cause analysis, and operational troubleshooting
agent-skillsagentic-aiagentsai-agentsaiopsawsaws-devops-agentcloud-operations
Source: GitHub repository metadata.
Assisted Log Enabler for AWS - Find AWS resources that are not logging, and turn them on.
awsblue-teamflow-logsincident-responseloggingsecurity-tools
Source: GitHub repository metadata.
A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.
bashblue-teamevasionincident-responseinfoseclinuxlinux-shellobfuscation
Source: GitHub repository metadata.
This repository is created only for infosec professionals whom work day to day basis to equip ourself with uptodate skillset, We can daily contribute daily one hour for day to day tasks and work on problem statements daily, Please contribute by providing problem statements and solutions
auditingblueteamcomplianceforensicsincident-responseinformation-securitymalware-analysisosint
Source: GitHub repository metadata.
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
agentic-aiai-securityalert-triageblue-teamcybersecuritydetection-engineeringincident-responselanggraph
Source: GitHub repository metadata.
PowerShell Digital Forensics & Incident Response Scripts.
forensics-toolsincident-responsepowershell
Source: GitHub repository metadata.
RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.
cybersecuritydfirdigitalforensicsforensicsincident-responseincident-response-toolingrdpsecurity
Source: GitHub repository metadata.
Security-oriented three-axis observability for sandboxed AI agents: model intent, app context, and runtime telemetry into verifiable evidence graphs for risk, forensics, and audit.
agent-observabilityagent-securityai-agentsai-securityapplication-securitycausality-graphdigital-forensicsebpf
Source: GitHub repository metadata.
Agentic DFIR
aiai-agentsclaude-codedfirdigital-forensicsforensicsincident-responsemcp
Source: GitHub repository metadata.
Cyber-investigation Analysis Standard Expression (CASE) Ontology
case-ontologycaseontologycriminal-justicedigital-forensicsincident-responseintelligenceinvestigationsjson-ld
Source: GitHub repository metadata.
CTI Blueprints is a free suite of templates and tools that helps Cyber Threat Intelligence analysts create high-quality, actionable reports more consistently and efficiently.
ctidcyber-threat-intelligencecybersecurityincident-responsemalware-analysismitre-attackthreat-actorsthreat-informed-defense
Source: GitHub repository metadata.
FAME Automates Malware Evaluation
frameworkincident-responseinfosecmalwaremalware-analysismalware-research
Source: GitHub repository metadata.
IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
alertsautomationcertcsirtcybersecurityfeedshandlingihap
Source: GitHub repository metadata.
A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
analysiscyber-crimedfirforensicsgraphincident-responseinvestigationsecurity
Source: GitHub repository metadata.
What this index tells you
We collect selected public repository metadata through GitHub’s official API and store it on our server. This is not a complete index of GitHub. Categories come from discovery queries and topics; a “skills” or “plugins” result is not a verified installation format. We do not run or audit the projects listed here.
Check the original repository’s licence, installation instructions and maintenance history before using it. Stars do not establish security, and a recent push does not prove that a project works. GitHub may have newer information than our last indexed record.
Search is lexical, not an AI answer engine. Short words and spelling differences can affect matches. This site is independent of GitHub. Report a wrong category, stale result or removal request.