Forensics & Incident Response OSS tools — 17 tracked with release & CVE alerts

SIPCAPTURE Homer Healthy open source

Troubleshooting and monitoring VoIP calls.

VAST Healthy open source

Open source security data pipeline engine for structured event data, supporting high-volume telemetry ingestion, compaction, and retrieval; purpose-built for security content execution, guided threat hunting, and large-scale investigation.

Maigret Healthy open source

♂ Collect a dossier on a person by username from 3000+ sites

CyberChef Healthy open source

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

Chainsaw Healthy open source

Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows event logs.

AVML Healthy open source

AVML - Acquire Volatile Memory for Linux

Rizin Healthy open source

UNIX-like reverse engineering framework and command-line toolset.

Timesketch Healthy open source

Collaborative forensic timeline analysis

Hindsight Healthy open source

Browser forensics tool for Google Chrome (and other Chromium-based browsers)

Quark-Engine Healthy open source

An Obfuscation-Neglect Android Malware Scoring System.

Zentral Healthy open source

Zentral is a high-visibility platform for controlling Apple endpoints in enterprises. It brings great observability to IT and makes tracking & reporting compliance much less manual.

Ghidra Healthy open source

Ghidra is a software reverse engineering (SRE) framework

beelzebub Healthy open source

Honeypot framework designed to provide a highly secure environment for detecting and analyzing cyber attacks.

Velociraptor Healthy open source

Digging Deeper....

osquery Healthy open source

SQL powered operating system instrumentation, monitoring, and analytics

Radare2 Healthy open source

UNIX-like reverse engineering framework and command-line toolset

go-audit Healthy open source

go-audit is an alternative to the auditd daemon that ships with many distros

Tools