#incident-response (30 Repositories)
Ranked open-source repositories tagged with #incident-response, scored by pull request acceptance likelihood and maintainer engagement velocity.
73.5%
92.3h
30 repositories tagged #incident-response
utmstack/UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
Velocidex/velociraptor
Digging Deeper....
OneUptime/oneuptime
Complete open-source monitoring and observability platform.
ongridio/ongrid
An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it — right from Slack, Telegram, Lark or DingTalk.
Vigil-SOC/vigil
Vigil: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.
beenuar/AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
TracecatHQ/tracecat
Open-source security automation platform for teams and AI agents
oxynote/oxynote
Your system, with subtitles. Notion-style pages with live observability charts, Stripe-style API docs and pull-request-style reviews
tenzir/tenzir
Tenzir is the data pipeline engine for security teams.
Karib0u/rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
jmpsec/osctrl
Fast and efficient osquery management
sleuthkit/sleuthkit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
puffyCid/artemis
A cross platform forensic parser written in Rust!
mrwadams/attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
MISP/misp-taxonomies
Taxonomies used in MISP taxonomy system and can be used by other information sharing tool.
dfir-iris/iris-web
Collaborative Incident Response platform
InfosecHouse/InfosecHouse
Tools & Resources for Cyber Security Operations
TheHive-Project/Cortex-Analyzers
Cortex Analyzers Repository
tclahr/uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
nitefood/asn
ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / URL / ASPath / Organization / IP reputation / IP geolocation / IP fingerprinting / Network recon / lookup API server / Web traceroute server
LeeMangold/OpenGRC
Self-hosted GRC platform for small and mid-sized security teams: risk management, controls, audits, vendor risk and incident response for ISO 27001, SOC 2, NIST CSF, HIPAA, and more.
LETHAL-FORENSICS/Microsoft-Analyzer-Suite
A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID
cgosec/Blauhaunt
A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts
turbot/tailpipe
select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.
thalesgroup-cert/Watcher
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
AppliedIR/Valhuntir
Valhuntir CLI — AI-augmented incident response platform
swapnildahiphale/OpenSRE
OpenSRE — the memory-first AI SRE. Self-hosted incident investigation with episodic memory, knowledge graph, web console, Slack & Teams. opensre.in
incidentbot/incidentbot
The Open Source Incident Management Framework
Neo23x0/Loki-RS
🐍 High-performance, multi-threaded YARA & IOC scanner
LETHAL-FORENSICS/MemProcFS-Analyzer
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR