incident-response.json

{
    "source": "github_topic",
    "topic": "incident-response",
    "count": 100,
    "results": [
        {
            "full_name": "wazuh/wazuh",
            "html_url": "https://github.com/wazuh/wazuh",
            "description": "Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.",
            "language": "C",
            "stars": 13995,
            "topics": [
                "cloud-security",
                "compliance",
                "configuration-assessement",
                "container-security",
                "cybersecurity",
                "file-integrity-monitoring",
                "incident-response",
                "infosec",
                "log-analysis",
                "malware-detection",
                "pci-dss",
                "security",
                "security-audit",
                "security-automation",
                "security-hardening",
                "security-tools",
                "siem",
                "vulnerability-detection",
                "wazuh",
                "xdr"
            ]
        },
        {
            "full_name": "dastergon/awesome-sre",
            "html_url": "https://github.com/dastergon/awesome-sre",
            "description": "A curated list of Site Reliability and Production Engineering resources.",
            "language": "",
            "stars": 12810,
            "topics": [
                "alerting",
                "availability",
                "awesome",
                "awesome-list",
                "capacity-planning",
                "devops",
                "incident-response",
                "list",
                "monitoring",
                "on-call",
                "post-mortem",
                "postmortem",
                "production",
                "reliability",
                "reliability-engineering",
                "scalability",
                "service-level-agreement",
                "site-reliability",
                "site-reliability-engineering",
                "sre"
            ]
        },
        {
            "full_name": "kubeshark/kubeshark",
            "html_url": "https://github.com/kubeshark/kubeshark",
            "description": "The API traffic analyzer for Kubernetes providing real-time K8s protocol-level visibility, capturing and monitoring all traffic and payloads going in, out and across containers, pods, nodes and clusters. Inspired by Wireshark, purposely built for Kubernetes",
            "language": "Go",
            "stars": 11560,
            "topics": [
                "amqp",
                "cloud-native",
                "devops",
                "devops-tools",
                "docker",
                "forensics",
                "go",
                "golang",
                "grpc",
                "incident-response",
                "kafka",
                "kubernetes",
                "microservice",
                "microservices",
                "microservices-application",
                "observability",
                "redis",
                "rest",
                "sniffer",
                "wireshark"
            ]
        },
        {
            "full_name": "upgundecha/howtheysre",
            "html_url": "https://github.com/upgundecha/howtheysre",
            "description": "A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)",
            "language": "JavaScript",
            "stars": 9592,
            "topics": [
                "alerting",
                "chaos-engineering",
                "dev-ops",
                "devops",
                "hacktoberfest",
                "hacktoberfest-accepted",
                "incident-management",
                "incident-response",
                "infrastructure",
                "ml-ops",
                "monitoring",
                "observability",
                "on-call",
                "post-mortem",
                "reliability",
                "security",
                "site-reliability-engineering",
                "software-engineering",
                "sre",
                "sre-culture"
            ]
        },
        {
            "full_name": "toniblyx/my-arsenal-of-aws-security-tools",
            "html_url": "https://github.com/toniblyx/my-arsenal-of-aws-security-tools",
            "description": "List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.",
            "language": "Shell",
            "stars": 9341,
            "topics": [
                "auditing",
                "aws-infrastructure",
                "aws-inventory",
                "aws-lambda",
                "cloud",
                "cloudtrail",
                "dfir",
                "iam",
                "incident-response",
                "security",
                "security-tools"
            ]
        },
        {
            "full_name": "meirwah/awesome-incident-response",
            "html_url": "https://github.com/meirwah/awesome-incident-response",
            "description": "A curated list of tools for incident response",
            "language": "",
            "stars": 8609,
            "topics": [
                "awesome",
                "awesome-list",
                "cybersecurity",
                "dfir",
                "incident-response",
                "incident-response-tooling",
                "list",
                "security"
            ]
        },
        {
            "full_name": "OneUptime/oneuptime",
            "html_url": "https://github.com/OneUptime/oneuptime",
            "description": "Complete open-source monitoring and observability platform.",
            "language": "TypeScript",
            "stars": 6166,
            "topics": [
                "devops",
                "incident-management",
                "incident-response",
                "monitoring",
                "observability",
                "on-call",
                "status-page"
            ]
        },
        {
            "full_name": "0x4D31/awesome-threat-detection",
            "html_url": "https://github.com/0x4D31/awesome-threat-detection",
            "description": "✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️",
            "language": "",
            "stars": 4411,
            "topics": [
                "awesome",
                "awesome-list",
                "detection",
                "incident-response",
                "security",
                "threat-detection",
                "threat-hunting"
            ]
        },
        {
            "full_name": "intelowlproject/IntelOwl",
            "html_url": "https://github.com/intelowlproject/IntelOwl",
            "description": "IntelOwl: manage your Threat Intelligence at scale",
            "language": "Python",
            "stars": 4354,
            "topics": [
                "cyber-security",
                "cyber-threat-intelligence",
                "cybersecurity",
                "dfir",
                "enrichment",
                "hacktoberfest",
                "honeynet",
                "incident-response",
                "intel-owl",
                "ioc",
                "malware-analysis",
                "malware-analyzer",
                "osint",
                "osint-python",
                "python",
                "security-tools",
                "threat-hunting",
                "threat-intelligence",
                "threathunting",
                "threatintel"
            ]
        },
        {
            "full_name": "TheHive-Project/TheHive",
            "html_url": "https://github.com/TheHive-Project/TheHive",
            "description": "TheHive: a Scalable, Open Source and Free Security Incident Response Platform",
            "language": "Scala",
            "stars": 3857,
            "topics": [
                "agplv3",
                "analyzer",
                "api",
                "cortex",
                "dfir",
                "digital-forensics",
                "free",
                "incident-management",
                "incident-response",
                "incident-response-tooling",
                "investigations",
                "iocs",
                "misp",
                "open-source",
                "orchestration",
                "platform",
                "rest",
                "scala",
                "security-incidents",
                "thehive"
            ]
        },
        {
            "full_name": "A-poc/BlueTeam-Tools",
            "html_url": "https://github.com/A-poc/BlueTeam-Tools",
            "description": "Tools and Techniques for Blue Team / Incident Response",
            "language": "",
            "stars": 3699,
            "topics": [
                "blue-team",
                "blueteam",
                "cheatsheet",
                "cyber-security",
                "defender",
                "incident",
                "incident-response",
                "malware-analysis",
                "resources",
                "tools",
                "vulnerability-management",
                "wiki"
            ]
        },
        {
            "full_name": "volatilityfoundation/volatility3",
            "html_url": "https://github.com/volatilityfoundation/volatility3",
            "description": "Volatility 3.0 development",
            "language": "Python",
            "stars": 3682,
            "topics": [
                "digital-investigation",
                "forensics",
                "incident-response",
                "malware",
                "memory",
                "python",
                "ram",
                "volatility",
                "volatility-framework"
            ]
        },
        {
            "full_name": "Velocidex/velociraptor",
            "html_url": "https://github.com/Velocidex/velociraptor",
            "description": "Digging Deeper....",
            "language": "Go",
            "stars": 3585,
            "topics": [
                "digital-forensics",
                "endpoint-discovery",
                "endpoint-protection",
                "endpoint-security",
                "forensics-investigations",
                "incident-response",
                "inventory-management"
            ]
        },
        {
            "full_name": "TracecatHQ/tracecat",
            "html_url": "https://github.com/TracecatHQ/tracecat",
            "description": "All-in-one AI automation platform (workflows, agents, cases, tables) for security, IT, and infra teams.",
            "language": "Python",
            "stars": 3359,
            "topics": [
                "automation",
                "cybersecurity",
                "event-driven",
                "fastapi",
                "incident-response",
                "llm",
                "low-code",
                "monitoring",
                "nextjs",
                "openapi",
                "orchestration",
                "pydantic",
                "security",
                "temporalio",
                "workflow-engine"
            ]
        },
        {
            "full_name": "Yamato-Security/hayabusa",
            "html_url": "https://github.com/Yamato-Security/hayabusa",
            "description": "Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.",
            "language": "Rust",
            "stars": 2922,
            "topics": [
                "attack",
                "cybersecurity",
                "detection",
                "dfir",
                "event",
                "forensics",
                "hayabusa",
                "hunting",
                "incident",
                "incident-response",
                "logs",
                "response",
                "rust",
                "security",
                "security-automation",
                "sigma",
                "threat",
                "threat-hunting",
                "windows",
                "yamato"
            ]
        },
        {
            "full_name": "sleuthkit/sleuthkit",
            "html_url": "https://github.com/sleuthkit/sleuthkit",
            "description": "The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence. ",
            "language": "C++",
            "stars": 2921,
            "topics": [
                "forensics",
                "incident-response",
                "ntfs",
                "sleuthkit",
                "tct"
            ]
        },
        {
            "full_name": "danieldurnea/FBI-tools",
            "html_url": "https://github.com/danieldurnea/FBI-tools",
            "description": "🕵️ OSINT Tools for gathering information and actions forensics 🕵️ ",
            "language": "",
            "stars": 2273,
            "topics": [
                "awesome",
                "awesome-list",
                "bug-bounty",
                "cybersecurity",
                "forensics",
                "hacking",
                "incident-response",
                "infosec",
                "osint",
                "penetration-testing",
                "pentesting",
                "reconnaissance",
                "security",
                "security-automation",
                "security-tools"
            ]
        },
        {
            "full_name": "mattnotmax/cyberchef-recipes",
            "html_url": "https://github.com/mattnotmax/cyberchef-recipes",
            "description": "A list of cyber-chef recipes and curated links",
            "language": "",
            "stars": 2151,
            "topics": [
                "cyberchef",
                "cyberchef-recipes",
                "data-manipulation",
                "dfir",
                "incident-response",
                "malware",
                "regular-expression"
            ]
        },
        {
            "full_name": "last-byte/PersistenceSniper",
            "html_url": "https://github.com/last-byte/PersistenceSniper",
            "description": "Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte",
            "language": "PowerShell",
            "stars": 2038,
            "topics": [
                "incident-response",
                "malware-detection",
                "persistence",
                "powershell",
                "powershell-module",
                "powershell-script",
                "registry",
                "techniques",
                "windows"
            ]
        },
        {
            "full_name": "Bashfuscator/Bashfuscator",
            "html_url": "https://github.com/Bashfuscator/Bashfuscator",
            "description": "A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.",
            "language": "Python",
            "stars": 1871,
            "topics": [
                "bash",
                "blue-team",
                "evasion",
                "incident-response",
                "infosec",
                "linux",
                "linux-shell",
                "obfuscation",
                "red-team"
            ]
        },
        {
            "full_name": "nitefood/asn",
            "html_url": "https://github.com/nitefood/asn",
            "description": "ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / URL / ASPath / Organization / IP reputation / IP geolocation / IP fingerprinting / Network recon / lookup API server / Web traceroute server",
            "language": "Shell",
            "stars": 1783,
            "topics": [
                "api",
                "as-path",
                "asn",
                "asn-lookup",
                "autonomous-systems",
                "bash",
                "bgp",
                "fingerprinting",
                "geolocation",
                "incident-response",
                "ip-lookup",
                "ip-reputation",
                "mtr",
                "osint",
                "recon",
                "rpki",
                "shodan",
                "team-cymru",
                "traceroute",
                "whois"
            ]
        },
        {
            "full_name": "cyb3rxp/awesome-soc",
            "html_url": "https://github.com/cyb3rxp/awesome-soc",
            "description": "A collection of sources of documentation, as well as field best practices, to build/run a SOC",
            "language": "",
            "stars": 1557,
            "topics": [
                "architecture",
                "cert",
                "csirt",
                "detection",
                "incident-response",
                "management",
                "mitre-attack",
                "purpleteam",
                "risk-management",
                "siem",
                "sirp",
                "soa",
                "soar",
                "soc",
                "tip",
                "ttp"
            ]
        },
        {
            "full_name": "monzo/response",
            "html_url": "https://github.com/monzo/response",
            "description": "Monzo's real-time incident response and reporting tool ⚡️",
            "language": "JavaScript",
            "stars": 1545,
            "topics": [
                "incident",
                "incident-management",
                "incident-reports",
                "incident-response",
                "response",
                "slack-bot"
            ]
        },
        {
            "full_name": "austinsonger/Incident-Playbook",
            "html_url": "https://github.com/austinsonger/Incident-Playbook",
            "description": "GOAL: Incident Response Playbooks Mapped to MITRE Attack Tactics and Techniques. [Contributors Friendly]",
            "language": "",
            "stars": 1520,
            "topics": [
                "catalog",
                "contributions-welcome",
                "contributors-welcome",
                "cybersecurity",
                "cybersecurity-playbook",
                "incident-management",
                "incident-response",
                "incidents",
                "mitre",
                "mitre-attack",
                "playbook"
            ]
        },
        {
            "full_name": "HolmesGPT/holmesgpt",
            "html_url": "https://github.com/HolmesGPT/holmesgpt",
            "description": "Your 24/7 On-Call AI Agent - Solve Alerts Faster with Automatic Correlations, Investigations, and More",
            "language": "Python",
            "stars": 1512,
            "topics": [
                "aiops",
                "chatbot",
                "chatops",
                "devops",
                "devops-tools",
                "incident",
                "incident-management",
                "incident-response",
                "jira",
                "kubernetes",
                "llm",
                "llm-agent",
                "llm-framework",
                "llms",
                "monitoring",
                "observability",
                "prometheus",
                "site-reliability-engineering",
                "slack",
                "sre"
            ]
        },
        {
            "full_name": "TheHive-Project/Cortex",
            "html_url": "https://github.com/TheHive-Project/Cortex",
            "description": "Cortex: a Powerful Observable Analysis and Active Response Engine",
            "language": "Scala",
            "stars": 1508,
            "topics": [
                "analysis",
                "analyzer",
                "api",
                "cortex",
                "cyber-threat-intelligence",
                "dfir",
                "digital-forensics",
                "engine",
                "free",
                "free-software",
                "incident-response",
                "iocs",
                "observable",
                "open-source",
                "python",
                "response",
                "rest",
                "scala",
                "security-incidents",
                "thehive"
            ]
        },
        {
            "full_name": "dastergon/postmortem-templates",
            "html_url": "https://github.com/dastergon/postmortem-templates",
            "description": "A collection of postmortem templates",
            "language": "",
            "stars": 1401,
            "topics": [
                "devops",
                "incident-reporting",
                "incident-reports",
                "incident-response",
                "post-mortem",
                "postmortem",
                "postmortem-templates",
                "site-reliability",
                "site-reliability-engineering",
                "sre"
            ]
        },
        {
            "full_name": "ahmedkhlief/APT-Hunter",
            "html_url": "https://github.com/ahmedkhlief/APT-Hunter",
            "description": "APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity",
            "language": "Python",
            "stars": 1392,
            "topics": [
                "apt-attacks",
                "forensic-analysis",
                "incident-response",
                "purpleteam",
                "python3",
                "threat-hunting",
                "windows-event-logs",
                "windows-eventlog"
            ]
        },
        {
            "full_name": "yampelo/beagle",
            "html_url": "https://github.com/yampelo/beagle",
            "description": "Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.",
            "language": "Python",
            "stars": 1333,
            "topics": [
                "dfir",
                "digital-forensics",
                "forensic-analysis",
                "graph",
                "incident-response",
                "security",
                "threat-hunting"
            ]
        },
        {
            "full_name": "dfir-iris/iris-web",
            "html_url": "https://github.com/dfir-iris/iris-web",
            "description": "Collaborative Incident Response platform",
            "language": "Python",
            "stars": 1311,
            "topics": [
                "csirt-tooling",
                "digital-forensics",
                "digital-forensics-incident-response",
                "forensic",
                "forensic-analysis",
                "forensic-tools",
                "incident-response",
                "python"
            ]
        },
        {
            "full_name": "emalderson/ThePhish",
            "html_url": "https://github.com/emalderson/ThePhish",
            "description": "ThePhish: an automated phishing email analysis tool",
            "language": "Python",
            "stars": 1294,
            "topics": [
                "attack",
                "cyberdefense",
                "cybersecurity",
                "detection",
                "digital-forensics",
                "email",
                "free",
                "incident-response",
                "indicators-of-compromise",
                "malware",
                "misp",
                "phishing",
                "phishing-detection",
                "python",
                "script",
                "thehive",
                "thehive4",
                "thehive4py",
                "threat-intelligence",
                "webapp"
            ]
        },
        {
            "full_name": "mthcht/awesome-lists",
            "html_url": "https://github.com/mthcht/awesome-lists",
            "description": "Awesome Security lists for SOC/CERT/CTI",
            "language": "YARA",
            "stars": 1186,
            "topics": [
                "awesome-list",
                "blueteam",
                "blueteam-tools",
                "cti",
                "detection",
                "detection-engineering",
                "dfir",
                "hacktools",
                "incident-response",
                "ioc",
                "iocs",
                "ir",
                "ransomware",
                "redteam",
                "rmm",
                "security",
                "siem",
                "soc",
                "threat-hunting",
                "threat-intelligence"
            ]
        },
        {
            "full_name": "tclahr/uac",
            "html_url": "https://github.com/tclahr/uac",
            "description": "UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.",
            "language": "Shell",
            "stars": 1181,
            "topics": [
                "aix",
                "collector",
                "computer-forensics",
                "dfir",
                "esxi",
                "forensics",
                "freebsd",
                "incident-response",
                "linux",
                "live-response",
                "macos",
                "netbsd",
                "netscaler",
                "openbsd",
                "script",
                "security",
                "shell",
                "solaris",
                "terminal",
                "triage"
            ]
        },
        {
            "full_name": "certtools/intelmq",
            "html_url": "https://github.com/certtools/intelmq",
            "description": "IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.",
            "language": "Python",
            "stars": 1095,
            "topics": [
                "alerts",
                "automation",
                "cert",
                "csirt",
                "cybersecurity",
                "feeds",
                "handling",
                "ihap",
                "incident",
                "incident-response",
                "intelligence",
                "ioc",
                "malware",
                "phishing",
                "python",
                "threat"
            ]
        },
        {
            "full_name": "mdecrevoisier/Microsoft-eventlog-mindmap",
            "html_url": "https://github.com/mdecrevoisier/Microsoft-eventlog-mindmap",
            "description": "Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...",
            "language": "",
            "stars": 1087,
            "topics": [
                "active-directory",
                "azure",
                "evtx",
                "exchange",
                "incident-response",
                "mindmap",
                "windows"
            ]
        },
        {
            "full_name": "thalesgroup-cert/Watcher",
            "html_url": "https://github.com/thalesgroup-cert/Watcher",
            "description": "Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.",
            "language": "JavaScript",
            "stars": 1061,
            "topics": [
                "ai",
                "ai-threat-intelligence",
                "certificate-transparency",
                "certstream",
                "cyber-ai",
                "cybersecurity",
                "django",
                "huggingface",
                "incident-response",
                "misp",
                "monitoring",
                "osint",
                "phishing",
                "reactjs",
                "security",
                "thehive",
                "threat-detection",
                "threat-hunting",
                "threat-intelligence",
                "watcher"
            ]
        },
        {
            "full_name": "PagerDuty/incident-response-docs",
            "html_url": "https://github.com/PagerDuty/incident-response-docs",
            "description": "PagerDuty's Incident Response Documentation.",
            "language": "Dockerfile",
            "stars": 1033,
            "topics": [
                "documentation",
                "incident-response",
                "oncall",
                "pagerduty",
                "team-security"
            ]
        },
        {
            "full_name": "mikeroyal/Open-Source-Security-Guide",
            "html_url": "https://github.com/mikeroyal/Open-Source-Security-Guide",
            "description": "Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks. ",
            "language": "Go",
            "stars": 1024,
            "topics": [
                "compliance",
                "cyber-security",
                "detection-engineering",
                "forensics-tools",
                "incident-management",
                "incident-response",
                "information-security",
                "infosec",
                "intrusion-detection",
                "kali-linux",
                "mitre-attack",
                "network-analysis",
                "offensive-security",
                "pentesters",
                "privacy-protection",
                "scanning-tool",
                "siem",
                "surveillance",
                "vulnerabilities",
                "vulnerability-detection"
            ]
        },
        {
            "full_name": "wazuh/wazuh-docker",
            "html_url": "https://github.com/wazuh/wazuh-docker",
            "description": "Wazuh - Docker containers",
            "language": "Shell",
            "stars": 962,
            "topics": [
                "compliance",
                "docker",
                "elasticsearch",
                "file-integrity-management",
                "hacktoberfest",
                "hacktoberfest-accepted",
                "ids",
                "incident-response",
                "intrusion-detection",
                "log-analysis",
                "loganalyzer",
                "monitoring",
                "ossec",
                "pci-dss",
                "policy-monitoring",
                "security",
                "security-awareness",
                "security-hardening",
                "vulnerability-detection",
                "wazuh"
            ]
        },
        {
            "full_name": "cyb3rfox/Aurora-Incident-Response",
            "html_url": "https://github.com/cyb3rfox/Aurora-Incident-Response",
            "description": "Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders",
            "language": "JavaScript",
            "stars": 951,
            "topics": [
                "incident-management",
                "incident-response",
                "incident-response-tooling"
            ]
        },
        {
            "full_name": "certsocietegenerale/fame",
            "html_url": "https://github.com/certsocietegenerale/fame",
            "description": "FAME Automates Malware Evaluation",
            "language": "Python",
            "stars": 917,
            "topics": [
                "framework",
                "incident-response",
                "infosec",
                "malware",
                "malware-analysis",
                "malware-research"
            ]
        },
        {
            "full_name": "A3sal0n/CyberThreatHunting",
            "html_url": "https://github.com/A3sal0n/CyberThreatHunting",
            "description": "A collection of resources for Threat Hunters",
            "language": "Python",
            "stars": 909,
            "topics": [
                "cybersecurity",
                "dfir",
                "incident-response",
                "threat-hunting",
                "threat-intelligence"
            ]
        },
        {
            "full_name": "securitytemplates/sectemplates",
            "html_url": "https://github.com/securitytemplates/sectemplates",
            "description": "Open source templates you can use to bootstrap your security programs",
            "language": "",
            "stars": 879,
            "topics": [
                "bug-bounty",
                "incident-response",
                "penetration-testing",
                "security-exceptions",
                "security-partners",
                "vulnerability-management"
            ]
        },
        {
            "full_name": "Drew-Alleman/DataSurgeon",
            "html_url": "https://github.com/Drew-Alleman/DataSurgeon",
            "description": " Quickly Extracts IP's, Email Addresses, Hashes, Files, Credit Cards, Social Security Numbers and a lot More From Text",
            "language": "Rust",
            "stars": 874,
            "topics": [
                "bug-bounty",
                "ctf-tools",
                "cybersecurity",
                "email",
                "file-search",
                "hacking",
                "incident-response",
                "infosec",
                "ip-address",
                "osint",
                "pentesting",
                "recon",
                "reconnaissance",
                "regex",
                "rust",
                "rust-lang",
                "search",
                "search-tools",
                "security-tools",
                "windows"
            ]
        },
        {
            "full_name": "palantir/osquery-configuration",
            "html_url": "https://github.com/palantir/osquery-configuration",
            "description": "A repository for using osquery for incident detection and response",
            "language": "",
            "stars": 867,
            "topics": [
                "detection",
                "incident-response",
                "information-security",
                "octo-correct-managed",
                "osquery"
            ]
        },
        {
            "full_name": "DFIRKuiper/Kuiper",
            "html_url": "https://github.com/DFIRKuiper/Kuiper",
            "description": "Digital Forensics Investigation Platform",
            "language": "JavaScript",
            "stars": 858,
            "topics": [
                "artifacts",
                "dfir",
                "digital-forensics",
                "incident-response",
                "parser",
                "security"
            ]
        },
        {
            "full_name": "darkquasar/AzureHunter",
            "html_url": "https://github.com/darkquasar/AzureHunter",
            "description": "A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365",
            "language": "PowerShell",
            "stars": 789,
            "topics": [
                "azforensics",
                "azure",
                "azure-forensics",
                "azuresearcher",
                "cloud-forensics",
                "cybersecurity",
                "dfir",
                "digital-forensics",
                "incident-response",
                "powershellv5",
                "threat-hunting",
                "threathunting",
                "unifiedauditlog"
            ]
        },
        {
            "full_name": "counteractive/incident-response-plan-template",
            "html_url": "https://github.com/counteractive/incident-response-plan-template",
            "description": "A concise, directive, specific, flexible, and free incident response plan template",
            "language": "Makefile",
            "stars": 747,
            "topics": [
                "cybersecurity",
                "incident",
                "incident-management",
                "incident-response",
                "information-security",
                "infosec"
            ]
        },
        {
            "full_name": "securityjoes/MasterParser",
            "html_url": "https://github.com/securityjoes/MasterParser",
            "description": "MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs",
            "language": "PowerShell",
            "stars": 744,
            "topics": [
                "automation",
                "cyber",
                "cyber-security",
                "dfir",
                "dfir-automation",
                "digital-forensic",
                "incident-response",
                "infosec",
                "ir",
                "mdr",
                "powershell",
                "reporting",
                "security",
                "soc",
                "tools"
            ]
        },
        {
            "full_name": "Bert-JanP/Incident-Response-Powershell",
            "html_url": "https://github.com/Bert-JanP/Incident-Response-Powershell",
            "description": "PowerShell Digital Forensics & Incident Response Scripts.",
            "language": "PowerShell",
            "stars": 716,
            "topics": [
                "forensics-tools",
                "incident-response",
                "powershell"
            ]
        },
        {
            "full_name": "tenzir/tenzir",
            "html_url": "https://github.com/tenzir/tenzir",
            "description": "Tenzir is the data pipeline engine for security teams.",
            "language": "C++",
            "stars": 705,
            "topics": [
                "dataops",
                "hacktoberfest",
                "incident-response",
                "investigation",
                "netflow",
                "pcap",
                "pipelines",
                "secdataops",
                "security",
                "siem",
                "sigma",
                "soc",
                "suricata",
                "threathunting",
                "zeek"
            ]
        },
        {
            "full_name": "LETHAL-FORENSICS/MemProcFS-Analyzer",
            "html_url": "https://github.com/LETHAL-FORENSICS/MemProcFS-Analyzer",
            "description": "MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR",
            "language": "PowerShell",
            "stars": 689,
            "topics": [
                "dfir",
                "digital-forensics",
                "incident-response",
                "live-response",
                "memory-forensics",
                "memprocfs",
                "powershell"
            ]
        },
        {
            "full_name": "cristianzsh/forensictools",
            "html_url": "https://github.com/cristianzsh/forensictools",
            "description": "Collection of forensic tools",
            "language": "Inno Setup",
            "stars": 669,
            "topics": [
                "binary-analysis",
                "dfir",
                "forensic-examinations",
                "forensics",
                "forensics-tools",
                "incident-response",
                "toolkit",
                "tools"
            ]
        },
        {
            "full_name": "atc-project/atc-react",
            "html_url": "https://github.com/atc-project/atc-react",
            "description": "A knowledge base of actionable Incident Response techniques",
            "language": "Python",
            "stars": 654,
            "topics": [
                "amitt",
                "dfir",
                "incident-response",
                "mitre-attack",
                "response-playbooks",
                "thehive"
            ]
        },
        {
            "full_name": "aws-samples/aws-customer-playbook-framework",
            "html_url": "https://github.com/aws-samples/aws-customer-playbook-framework",
            "description": "This repository provides sample templates for security playbooks against various scenarios when using Amazon Web Services. ",
            "language": "",
            "stars": 642,
            "topics": [
                "aws",
                "incident-response",
                "playbooks"
            ]
        },
        {
            "full_name": "Patrowl/PatrowlManager",
            "html_url": "https://github.com/Patrowl/PatrowlManager",
            "description": "PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform",
            "language": "HTML",
            "stars": 639,
            "topics": [
                "api",
                "automation",
                "incident-response",
                "ioc",
                "orchestration",
                "patrowl",
                "scans",
                "secops",
                "security-automation",
                "security-scanner",
                "security-tools",
                "thehive",
                "threat-hunting",
                "threat-intelligence",
                "vulnerabilities",
                "vulnerability-detection",
                "vulnerability-management",
                "vulnerability-scanners"
            ]
        },
        {
            "full_name": "stuhli/awesome-event-ids",
            "html_url": "https://github.com/stuhli/awesome-event-ids",
            "description": "Collection of Event ID ressources useful for Digital Forensics and Incident Response",
            "language": "",
            "stars": 635,
            "topics": [
                "dfir",
                "digitalforensics",
                "forensics",
                "incident-response",
                "ir"
            ]
        },
        {
            "full_name": "msuiche/OPCDE",
            "html_url": "https://github.com/msuiche/OPCDE",
            "description": "OPCDE Cybersecurity Conference Materials",
            "language": "C++",
            "stars": 619,
            "topics": [
                "cybersecurity",
                "incident-response",
                "information-security",
                "vulnerability"
            ]
        },
        {
            "full_name": "mir1ce/Hawkeye",
            "html_url": "https://github.com/mir1ce/Hawkeye",
            "description": "Windows应急响应工具---Hawkeye(鹰眼)。集Windows日志分析，进程扫描，主机信息于一体的综合应急响应分析工具",
            "language": "",
            "stars": 617,
            "topics": [
                "cyber-security",
                "dfir",
                "emergency-response",
                "golang",
                "gui",
                "incident-response",
                "log-analysis",
                "soc",
                "threat-hunting",
                "windows"
            ]
        },
        {
            "full_name": "mthcht/ThreatHunting-Keywords",
            "html_url": "https://github.com/mthcht/ThreatHunting-Keywords",
            "description": "Awesome list of keywords and artifacts for Threat Hunting sessions",
            "language": "PowerShell",
            "stars": 615,
            "topics": [
                "awesome-list",
                "blueteam",
                "detection-engineering",
                "dfir",
                "elk-stack",
                "endpoint-security",
                "forensic",
                "hacktools",
                "incident-response",
                "iocs",
                "offensive-scripts",
                "offensive-security",
                "redteam",
                "siem",
                "soc",
                "splunk",
                "threat-hunting",
                "threat-intelligence",
                "threathunting",
                "yara-rules"
            ]
        },
        {
            "full_name": "Johnng007/Live-Forensicator",
            "html_url": "https://github.com/Johnng007/Live-Forensicator",
            "description": "A suite of Tools to aid Incidence Response and Live Forensics for - Windows (Powershell) | Linux (Bash) | MacOS (Shell) ",
            "language": "JavaScript",
            "stars": 600,
            "topics": [
                "bash",
                "eventlog-analysis",
                "eventlogs",
                "forensicator",
                "forensics",
                "forensics-investigations",
                "incident-response",
                "linux",
                "linux-shell",
                "live-forensic",
                "log4j",
                "macos",
                "powershell",
                "ransomeware"
            ]
        },
        {
            "full_name": "LETHAL-FORENSICS/Microsoft-Analyzer-Suite",
            "html_url": "https://github.com/LETHAL-FORENSICS/Microsoft-Analyzer-Suite",
            "description": "A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID",
            "language": "PowerShell",
            "stars": 560,
            "topics": [
                "azure-active-directory",
                "incident-response",
                "microsoft-365",
                "microsoft-entra",
                "microsoft-graph",
                "powershell"
            ]
        },
        {
            "full_name": "incidentalhq/incidental",
            "html_url": "https://github.com/incidentalhq/incidental",
            "description": "An opensource incident management platform integrating with Slack.",
            "language": "Python",
            "stars": 556,
            "topics": [
                "incident",
                "incident-management",
                "incident-response",
                "open-source",
                "python3",
                "react"
            ]
        },
        {
            "full_name": "dfirtrack/dfirtrack",
            "html_url": "https://github.com/dfirtrack/dfirtrack",
            "description": "DFIRTrack - The Incident Response Tracking Application",
            "language": "Python",
            "stars": 527,
            "topics": [
                "dfir",
                "digital-forensics",
                "incident-management",
                "incident-response",
                "incident-response-tooling"
            ]
        },
        {
            "full_name": "turbot/tailpipe",
            "html_url": "https://github.com/turbot/tailpipe",
            "description": "select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.",
            "language": "Go",
            "stars": 519,
            "topics": [
                "aws",
                "azure",
                "detections",
                "devops",
                "duckdb",
                "forensics",
                "gcp",
                "incident-response",
                "log-analysis",
                "mitre-attack",
                "open-source",
                "parquet",
                "siem",
                "tailpipe",
                "threat-detection"
            ]
        },
        {
            "full_name": "digitalisx/awesome-memory-forensics",
            "html_url": "https://github.com/digitalisx/awesome-memory-forensics",
            "description": "A curated list of awesome Memory Forensics for DFIR",
            "language": "",
            "stars": 500,
            "topics": [
                "awesome",
                "awesome-list",
                "digital-forensics",
                "digital-forensics-incident-response",
                "forensics",
                "incident-response",
                "malware",
                "malware-analysis",
                "malware-research",
                "memory",
                "memory-analysis"
            ]
        },
        {
            "full_name": "SecurityBrewery/catalyst",
            "html_url": "https://github.com/SecurityBrewery/catalyst",
            "description": "⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes",
            "language": "Vue",
            "stars": 490,
            "topics": [
                "dfir",
                "digital-forensics",
                "incident-response",
                "soar"
            ]
        },
        {
            "full_name": "wazuh/wazuh-ruleset",
            "html_url": "https://github.com/wazuh/wazuh-ruleset",
            "description": "Wazuh - Ruleset",
            "language": "Python",
            "stars": 490,
            "topics": [
                "compliance",
                "elasticsearch",
                "file-integrity-management",
                "ids",
                "incident-response",
                "intrusion-detection",
                "log-analysis",
                "loganalyzer",
                "monitoring",
                "openscap",
                "ossec",
                "pci-dss",
                "policy-monitoring",
                "security",
                "security-awareness",
                "security-hardening",
                "vulnerability-detection",
                "wazuh"
            ]
        },
        {
            "full_name": "diogo-fernan/ir-rescue",
            "html_url": "https://github.com/diogo-fernan/ir-rescue",
            "description": "A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.",
            "language": "Batchfile",
            "stars": 488,
            "topics": [
                "bash",
                "batch",
                "cybersecurity",
                "dfir",
                "forensics",
                "incident-response",
                "malware",
                "nirsoft",
                "sysinternals",
                "unix",
                "windows"
            ]
        },
        {
            "full_name": "wazuh/wazuh-dashboard-plugins",
            "html_url": "https://github.com/wazuh/wazuh-dashboard-plugins",
            "description": "Plugins for Wazuh Dashboard",
            "language": "TypeScript",
            "stars": 486,
            "topics": [
                "compliance",
                "file-integrity-management",
                "gdpr",
                "ids",
                "incident-response",
                "intrusion-detection",
                "log-analysis",
                "loganalyzer",
                "monitoring",
                "openscap",
                "opensearch-dashboards",
                "opensearch-plugins",
                "ossec",
                "pci-dss",
                "policy-monitoring",
                "security",
                "security-awareness",
                "security-hardening",
                "vulnerability-detection",
                "wazuh"
            ]
        },
        {
            "full_name": "LearningKijo/KQL",
            "html_url": "https://github.com/LearningKijo/KQL",
            "description": "Threat Hunting query in Microsoft 365 Defender, XDR. Provide out-of-the-box KQL hunting queries - App, Email, Identity and Endpoint.",
            "language": "",
            "stars": 483,
            "topics": [
                "edr",
                "incident-response",
                "kql",
                "kusto",
                "threat-hunting",
                "xdr"
            ]
        },
        {
            "full_name": "LearningKijo/SecurityResearcher-Note",
            "html_url": "https://github.com/LearningKijo/SecurityResearcher-Note",
            "description": "Cover various security approaches to attack techniques and also provides new discoveries about security breaches.",
            "language": "PowerShell",
            "stars": 481,
            "topics": [
                "attack-defense",
                "incident-response",
                "malware-analysis",
                "threat-hunting",
                "vulnerability"
            ]
        },
        {
            "full_name": "chenerlich/FCL",
            "html_url": "https://github.com/chenerlich/FCL",
            "description": "FCL (Fileless Command Lines) - Known command lines of fileless malicious executions",
            "language": "",
            "stars": 476,
            "topics": [
                "command-line",
                "fcl",
                "file-less",
                "incident-response",
                "malware",
                "malware-analysis",
                "malware-detection",
                "threat-hunting"
            ]
        },
        {
            "full_name": "stanfrbd/cyberbro",
            "html_url": "https://github.com/stanfrbd/cyberbro",
            "description": "A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.",
            "language": "Python",
            "stars": 472,
            "topics": [
                "blueteam",
                "cti",
                "cyber-threat-intelligence",
                "cybersecurity",
                "dfir",
                "docker",
                "hash",
                "incident-response",
                "infosec",
                "ioc",
                "ipinfo",
                "osint",
                "osint-python",
                "python",
                "security",
                "security-tools",
                "threat",
                "threat-hunting",
                "threat-intelligence",
                "virustotal"
            ]
        },
        {
            "full_name": "jmpsec/osctrl",
            "html_url": "https://github.com/jmpsec/osctrl",
            "description": "Fast and efficient osquery management",
            "language": "Go",
            "stars": 471,
            "topics": [
                "detection-infrastructure",
                "endpoint-security",
                "host-instrumentation",
                "incident-response",
                "infrastructure-management",
                "osquery",
                "security"
            ]
        },
        {
            "full_name": "TheHive-Project/Cortex-Analyzers",
            "html_url": "https://github.com/TheHive-Project/Cortex-Analyzers",
            "description": "Cortex Analyzers Repository",
            "language": "Python",
            "stars": 469,
            "topics": [
                "analyzer",
                "cortex",
                "cyber-threat-intelligence",
                "dfir",
                "digital-forensics",
                "enrichment",
                "free",
                "free-software",
                "incident-response",
                "ioc",
                "json",
                "observable",
                "open-source",
                "python",
                "thehive"
            ]
        },
        {
            "full_name": "eschultze/URLextractor",
            "html_url": "https://github.com/eschultze/URLextractor",
            "description": "Information gathering & website reconnaissance | https://phishstats.info/",
            "language": "Shell",
            "stars": 456,
            "topics": [
                "abuse",
                "domain",
                "incident-response",
                "information-extraction",
                "information-gathering",
                "malicious-domains",
                "malware",
                "osint",
                "phishing",
                "shodan",
                "virustotal",
                "whois"
            ]
        },
        {
            "full_name": "AzureAD/Azure-AD-Incident-Response-PowerShell-Module",
            "html_url": "https://github.com/AzureAD/Azure-AD-Incident-Response-PowerShell-Module",
            "description": "The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response.",
            "language": "PowerShell",
            "stars": 452,
            "topics": [
                "azuread",
                "incident-response",
                "powershell",
                "powershell-module"
            ]
        },
        {
            "full_name": "DFIR-ORC/dfir-orc",
            "html_url": "https://github.com/DFIR-ORC/dfir-orc",
            "description": "Forensics artefact collection tool for systems running Microsoft Windows ",
            "language": "C++",
            "stars": 425,
            "topics": [
                "collection",
                "dfir",
                "incident-response"
            ]
        },
        {
            "full_name": "getsavvyinc/savvy-cli",
            "html_url": "https://github.com/getsavvyinc/savvy-cli",
            "description": "Automatically capture and surface your team's tribal knowledge",
            "language": "Go",
            "stars": 424,
            "topics": [
                "ai",
                "automation",
                "charmbracelet",
                "cli",
                "devops",
                "devtool",
                "go",
                "golang",
                "incident-response",
                "llm",
                "oncall",
                "oncall-engineers",
                "playbooks",
                "runbooks",
                "security-audit",
                "sre",
                "support",
                "support-engineers",
                "terminal"
            ]
        },
        {
            "full_name": "guardsight/gsvsoc_cirt-playbook-battle-cards",
            "html_url": "https://github.com/guardsight/gsvsoc_cirt-playbook-battle-cards",
            "description": "Cyber Incident Response Team Playbook Battle Cards",
            "language": "",
            "stars": 423,
            "topics": [
                "cyber-security-team",
                "cyber-threats",
                "cybersecurity",
                "incident-response",
                "playbook-battle-cards",
                "secops"
            ]
        },
        {
            "full_name": "activecm/rita",
            "html_url": "https://github.com/activecm/rita",
            "description": "Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.",
            "language": "Go",
            "stars": 415,
            "topics": [
                "anomaly-detection",
                "beacons",
                "blue-team",
                "c2",
                "c2-detection",
                "command-and-control",
                "cyber-security",
                "incident-response",
                "intrusion-detection",
                "log-analysis",
                "network-monitoring",
                "network-traffic-analysis",
                "security-tools",
                "threat-hunting",
                "threat-intelligence",
                "zeek"
            ]
        },
        {
            "full_name": "cyb3rmik3/MDE-DFIR-Resources",
            "html_url": "https://github.com/cyb3rmik3/MDE-DFIR-Resources",
            "description": "A curated list of resources for DFIR through Microsoft Defender for Endpoint leveraging kusto queries, powershell scripts, tools such as KAPE and THOR Cloud and more.",
            "language": "",
            "stars": 415,
            "topics": [
                "curated-collections",
                "curated-list",
                "dfir",
                "digital-forensics",
                "digital-forensics-incident-response",
                "incident-response",
                "kql",
                "kusto",
                "kusto-query",
                "kusto-query-language",
                "live-response",
                "mde",
                "microsoft",
                "microsoft-defender-for-endpoint",
                "resources"
            ]
        },
        {
            "full_name": "WithSecureLabs/Kanvas",
            "html_url": "https://github.com/WithSecureLabs/Kanvas",
            "description": "A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.",
            "language": "Python",
            "stars": 406,
            "topics": [
                "dfir-tools",
                "incident-management",
                "incident-response",
                "incident-response-tooling"
            ]
        },
        {
            "full_name": "vm32/Linux-Incident-Response",
            "html_url": "https://github.com/vm32/Linux-Incident-Response",
            "description": "practical toolkit for cybersecurity and IT professionals. It features a detailed Linux cheatsheet for incident response ",
            "language": "Shell",
            "stars": 402,
            "topics": [
                "digital-forensics",
                "digital-forensics-incident-response",
                "incident-response",
                "ir",
                "linux"
            ]
        },
        {
            "full_name": "TheHive-Project/TheHiveDocs",
            "html_url": "https://github.com/TheHive-Project/TheHiveDocs",
            "description": "Documentation of TheHive",
            "language": "",
            "stars": 401,
            "topics": [
                "administration-guide",
                "analyst",
                "analyzer",
                "api",
                "cortex",
                "dfir",
                "digital-forensics",
                "documentation",
                "free",
                "free-software",
                "incident-response",
                "iocs",
                "misp",
                "open-source",
                "platform",
                "rest",
                "security-incidents",
                "thehive",
                "thehive-project"
            ]
        },
        {
            "full_name": "CybercentreCanada/assemblyline",
            "html_url": "https://github.com/CybercentreCanada/assemblyline",
            "description": "AssemblyLine 4: File triage and malware analysis",
            "language": "Python",
            "stars": 391,
            "topics": [
                "assemblyline",
                "automation-framework",
                "cert",
                "cyber-security",
                "cybersecurity",
                "document-analysis",
                "file-analysis",
                "framework",
                "incident-response",
                "infosec",
                "malware",
                "malware-analysis",
                "malware-analyzer",
                "malware-detection",
                "malware-research",
                "python3",
                "security-automation",
                "security-automation-framework",
                "security-tools"
            ]
        },
        {
            "full_name": "cloudtracer/ThreatPinchLookup",
            "html_url": "https://github.com/cloudtracer/ThreatPinchLookup",
            "description": "Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension",
            "language": "HTML",
            "stars": 379,
            "topics": [
                "alienvault",
                "censys",
                "cert",
                "chrome-extension",
                "circl",
                "cve",
                "dfir",
                "ibm-xforce",
                "incident-response",
                "misp",
                "osint",
                "passivetotal",
                "security",
                "shodan",
                "threat-hunting",
                "threat-sharing",
                "threatintel",
                "threatminer",
                "virustotal",
                "whois"
            ]
        },
        {
            "full_name": "wazuh/wazuh-ansible",
            "html_url": "https://github.com/wazuh/wazuh-ansible",
            "description": "Wazuh - Ansible playbook",
            "language": "Shell",
            "stars": 378,
            "topics": [
                "ansible",
                "compliance",
                "elasticsearch",
                "file-integrity-management",
                "hacktoberfest",
                "hacktoberfest-accepted",
                "ids",
                "incident-response",
                "intrusion-detection",
                "log-analysis",
                "loganalyzer",
                "monitoring",
                "ossec",
                "pci-dss",
                "policy-monitoring",
                "security",
                "security-awareness",
                "security-hardening",
                "vulnerability-detection",
                "wazuh"
            ]
        },
        {
            "full_name": "foorilla/allinfosecnews_sources",
            "html_url": "https://github.com/foorilla/allinfosecnews_sources",
            "description": "A list of online news & info sources in the InfoSec/Cybersecurity space",
            "language": "",
            "stars": 376,
            "topics": [
                "aggregator",
                "blogs",
                "cybersecurity",
                "devsecops",
                "exploits",
                "hacking",
                "incident-response",
                "infosec",
                "jobs",
                "news",
                "osint",
                "podcasts",
                "security",
                "threat-intelligence",
                "video",
                "vulnerabilities"
            ]
        },
        {
            "full_name": "utmstack/UTMStack",
            "html_url": "https://github.com/utmstack/UTMStack",
            "description": "Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.",
            "language": "Java",
            "stars": 363,
            "topics": [
                "cmmc",
                "compliance",
                "hipaa",
                "incident-response",
                "log-analysis",
                "log-parsing",
                "malware-detection",
                "security",
                "security-audit",
                "security-automation",
                "security-operations-center",
                "security-tools",
                "siem",
                "soar",
                "soc",
                "soc2",
                "threat-analysis",
                "threat-detection",
                "threat-hunting",
                "threat-intelligence"
            ]
        },
        {
            "full_name": "vespperhq/vespper",
            "html_url": "https://github.com/vespperhq/vespper",
            "description": "Open-source AI copilot that lets you chat with your observability data and code 🧙‍♂️ ",
            "language": "TypeScript",
            "stars": 356,
            "topics": [
                "aiops",
                "alerts",
                "chatops-ai",
                "contributions-welcome",
                "devtools",
                "first-contributions",
                "hacktoberfest",
                "hacktoberfest-accepted",
                "hacktoberfest2024",
                "incident",
                "incident-response",
                "incident-response-tooling",
                "llm",
                "llm-agent",
                "metrics",
                "monitoring",
                "observability",
                "oncall-engineers",
                "site-reliability-engineering",
                "traces"
            ]
        },
        {
            "full_name": "unskript/Awesome-CloudOps-Automation",
            "html_url": "https://github.com/unskript/Awesome-CloudOps-Automation",
            "description": "Cloud-ops automation runbooks that are ready to use. Build your own automations using the hundreds of drag and drop actions included in the repository.  Built on Jupyter Notebooks, our automation platform jumpstarts your SRE RunBook creation. 😎 published by the unSkript community.",
            "language": "Jupyter Notebook",
            "stars": 334,
            "topics": [
                "automation",
                "awesome",
                "awesome-list",
                "aws",
                "cloudops",
                "hacktoberfest",
                "health-check",
                "healthcheck",
                "incident-response",
                "jupyter",
                "python",
                "runbooks",
                "sre",
                "templates"
            ]
        },
        {
            "full_name": "joeavanzato/Trawler",
            "html_url": "https://github.com/joeavanzato/Trawler",
            "description": "PowerShell script helping Incident Responders discover potential adversary persistence mechanisms.",
            "language": "PowerShell",
            "stars": 322,
            "topics": [
                "blue-team",
                "dfir",
                "incident-response",
                "malware",
                "persistence",
                "powershell",
                "windows"
            ]
        },
        {
            "full_name": "WithSecureLabs/LinuxCatScale",
            "html_url": "https://github.com/WithSecureLabs/LinuxCatScale",
            "description": "Incident Response collection and processing scripts with automated reporting scripts",
            "language": "Shell",
            "stars": 315,
            "topics": [
                "collection",
                "countercept",
                "incident-response",
                "linux",
                "triage"
            ]
        },
        {
            "full_name": "op7ic/EDR-Testing-Script",
            "html_url": "https://github.com/op7ic/EDR-Testing-Script",
            "description": "Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads",
            "language": "Batchfile",
            "stars": 307,
            "topics": [
                "att",
                "edr",
                "edr-solutions",
                "incident-response",
                "mitre",
                "security",
                "security-audit"
            ]
        },
        {
            "full_name": "nasbench/MindMaps",
            "html_url": "https://github.com/nasbench/MindMaps",
            "description": "#ThreatHunting #DFIR #Malware #Detection Mind Maps",
            "language": "",
            "stars": 305,
            "topics": [
                "detection",
                "dfir",
                "forensics",
                "incident-response",
                "mindmap",
                "threat-hunting",
                "threat-intelligence",
                "windows"
            ]
        },
        {
            "full_name": "BSI-Bund/RdpCacheStitcher",
            "html_url": "https://github.com/BSI-Bund/RdpCacheStitcher",
            "description": "RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.",
            "language": "C++",
            "stars": 296,
            "topics": [
                "cybersecurity",
                "dfir",
                "digitalforensics",
                "forensics",
                "incident-response",
                "incident-response-tooling",
                "rdp",
                "security"
            ]
        },
        {
            "full_name": "MISP/misp-taxonomies",
            "html_url": "https://github.com/MISP/misp-taxonomies",
            "description": "Taxonomies used in MISP taxonomy system and can be used by other information sharing tool.",
            "language": "Python",
            "stars": 289,
            "topics": [
                "adversary",
                "classification",
                "enisa-threat-taxonomy",
                "government-classification-markings",
                "incident",
                "incident-classification",
                "incident-response",
                "incident-taxonomy",
                "information-exchange",
                "machine-tags",
                "malware",
                "misp-taxonomies",
                "misp-taxonomy",
                "security",
                "taxonomy"
            ]
        },
        {
            "full_name": "hevnsnt/Awesome_Incident_Response",
            "html_url": "https://github.com/hevnsnt/Awesome_Incident_Response",
            "description": "Awesome Incident Response",
            "language": "PowerShell",
            "stars": 283,
            "topics": [
                "blueteam",
                "crisis-management",
                "cybersecurity",
                "incident-response"
            ]
        }
    ]
}