TheHive - TheHive: a Scalable, Open Source and Free Security Incident Response Platform

•    Javascript

---

TheHive is a scalable 3-in-1 open source and free Security Incident Response Platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. It is the perfect companion to MISP. You can synchronize it with one or multiple MISP instances to start investigations out of MISP events. You can also export an investigation's results as a MISP event to help your peers detect and react to attacks you've dealt with. Additionally, when TheHive is used in conjunction with Cortex, security analysts and researchers can easily analyze tens if not hundred of observables. Collaboration is at the heart of TheHive. Multiple analysts can work on the same case simultaneously. For example, an analyst may deal with malware analysis while another may work on tracking C2 beaconing activity on proxy logs as soon as IOCs have been added by their coworker. Using TheHive's live stream, everyone can keep an eye on what's happening on the platform, in real time.

misp security-incidents analyzer iocs thehive digital-forensics incident-response rest api investigations analyst dfir free free-software open-source platform misp-events cortex agplv3

Kuiper - Digital Forensics Investigation Platform

•    Javascript

---

Kuiper is a digital investigation platform that provides a capabilities for the investigation team and individuals to parse, search, visualize collected evidences (evidences could be collected by fast traige script like Hoarder). In additional, collaborate with other team members on the same platform by tagging artifacts and present it as a timeline, as well as setting rules for automating the detection. The main purpose of this project is to aid in streamlining digital investigation activities and allow advanced analytics capabilities with the ability to handle a large amounts of data. With a large number of cases and a large number of team members, it becomes hard for team members collaboration, as well as events correlation and building rules to detect malicious activities. Kuiper solve these shortages.

security parser incident-response dfir artifacts digital-forensics

Cortex - Powerful Observable Analysis Engine

•    Scala

---

Cortex, an open source and free software, has been created by TheHive Project for this very purpose. Observables, such as IP and email addresses, URLs, domain names, files or hashes, can be analyzed one by one or in bulk mode using a Web interface. Analysts can also automate these operations thanks to the Cortex REST API. By using Cortex, you won't need to rewrite the wheel every time you'd like to use a service or a tool to analyze an observable and help you investigate the case at hand. Leverage one of the several analyzers it contains and if you are missing a tool or a service, create a suitable program easily and make it available for the whole team (or better, for the whole community) thanks to Cortex.

response dfir analysis analyzer thehive engine information rest api security-incidents digital-forensics iocs observable free free-software open-source

DFIRTrack - The Incident Response Tracking Application

•    Python

---

DFIRTrack (Digital Forensics and Incident Response Tracking application) is an open source web application mainly based on Django using a PostgreSQL database back end.

incident-response dfir digital-forensics incident-management incident-response-tooling

awesome-forensicstools - Awesome list of digital forensic tools

•    

---

Collection of digital forensics tools for verification, investigations, diagnostics and so on. Composed from: Bellingcat's Digital Forensics Tools list https://docs.google.com/document/d/1BfLPJpRtyq4RFtHJoNpvWQjmGnyVkfE2HYoICKOGguA, Forensics Wiki http://www.forensicswiki.org and assorted collections of forensic resources online. All contributions welcome. Please propose changes using github issue https://github.com/ivbeg/awesome-forensictools/issues or by direct writing pull request.

awesome awesome-list forensics forensic-analysis digital-forensics metadata investigative-journalism

Cortex-Analyzers - Cortex Analyzers Repository

•    Python

---

The following repository is used by TheHive Project to develop and store Cortex analyzers. Analyzers can be written in any programming language supported by Linux such as Python, Ruby, Perl, etc. Refer to the How to Write and Submit an Analyzer page for details on how to write and submit one.

thehive analyzer cortex free free-software open-source observable ioc json incident-response digital-forensics dfir cyber-threat-intelligence enrichment

TheHive4py - Python API Client for TheHive

•    Python

---

TheHive4py is a Python API client for TheHive, a scalable 3-in-1 open source and free security incident response platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. TheHive4py allows analysts to send alerts to TheHive out of different sources. Those alerts can then be previewed and imported into cases using pre-defined templates.

thehive incident-response digital-forensics free-software open-source dfir free api-client api

TheHiveDocs - Documentation of TheHive

•    

---

TheHive is a scalable 4-in-1 open source and free security incident response platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. Thanks to Cortex, our powerful free and open source analysis engine, you can analyze (and triage) observables at scale using more than 80 analyzers. Additionally and starting from TheHive 3.1.0, you can actively respond to threats and interact with your constituency and other parties thanks to Cortex responders.

misp security-incidents iocs thehive cortex administration-guide analyzer rest api incident-response digital-forensics analyst dfir free free-software documentation open-source platform

c-aff4 - An AFF4 C++ implementation.

•    C++

---

The Advanced Forensics File Format 4 (AFF4) is an open source format used for the storage of digital evidence and data. This project implementats a C/C++ library for creating, reading and manipulating AFF4 images. The project also includes the canonical aff4imager binary which provides a general purpose standalone imaging tool.

forensics compression-library compression-formats digital-forensics

Digital-Forensics-with-Kali-Linux - Digital Forensics with Kali Linux, published by Packt

•    

---

This is the code repository for Digital Forensics with Kali Linux, published by Packt. It contains all the supporting project files necessary to work through the book from start to finish. Kali Linux is a Linux-based distribution used mainly for penetration testing and digital forensics. It has a wide range of tools to help in forensics investigations and incident response mechanisms.

kali-linux kali-scripts digital-forensics forensics mobile-security hacking brute-force-attacks investigation forensics-investigations penetration-testing pentesting pentest-tool

dfdewey

•    Python

---

dfDewey is a digital forensics string extraction, indexing, and searching tool. bulk_extractor can also be installed from the GIFT PPA.

forensics dfir digital-forensics

go-prefetch - A golang implementation of a prefetch parser.

•    Go

---

This project is a parser for Microsoft prefetch files.

digital-forensics