CyberThreatHunting alternatives for AI agents.

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

DFIRTrack - The Incident Response Tracking Application

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

FAME Automates Malware Evaluation

A knowledge base of actionable Incident Response techniques

Volatility 3.0 development

A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.

Collaborative Incident Response platform

Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes

Forensics artefact collection tool for systems running Microsoft Windows

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

CRADLE is a collaborative platform for Cyber Threat Intelligence analysts. It streamlines threat investigations with integrated note-taking, automated data linking, interactive visualizations, and robust access control. Enhance your CTI workflow from analysis to reporting—all in one secure space.