#1
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
9.5K starsApr 17, 2026 pushdevopsShellIncident Response
$ npx skills add toniblyx/my-arsenal-of-aws-security-toolsAlternatives
Dfir Orc alternatives for AI agents.
Compare similar skills by workflow fit, trust score, quality, GitHub adoption, maintenance, and install readiness.
Current skill
Dfir Orc
Forensics artefact collection tool for systems running Microsoft Windows
84
Quality
83
Trust
440
Stars
#2
⚡️ Catalyst is a self-hosted, open source incident response platform and ticket system that helps to automate alert handling and incident response processes
530 starsJun 2, 2026 pushdevopsVueIncident Response
$ npx skills add SecurityBrewery/catalyst#3
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
3.2K starsJun 7, 2026 pushdevopsRustIncident Response
$ npx skills add Yamato-Security/hayabusa#4
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
720 starsMay 2, 2026 pushdevopsPowerShellIncident Response
$ npx skills add LETHAL-FORENSICS/MemProcFS-Analyzer#5
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
3.1K starsJun 12, 2026 pushdevopsCIncident Response
$ npx skills add sleuthkit/sleuthkit#6
A list of cyber-chef recipes and curated links
2.2K starsJun 14, 2024 pushdevopsIncident ResponseClaude Code
$ npx skills add mattnotmax/cyberchef-recipes#7
🐍 High-performance, multi-threaded YARA & IOC scanner
327 starsJun 15, 2026 pushdevopsRustIncident Response
$ npx skills add Neo23x0/Loki-RS#8
Cortex: a Powerful Observable Analysis and Active Response Engine
1.6K starsMay 20, 2026 pushdevopsScalaIncident Response
$ npx skills add TheHive-Project/Cortex#9
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
1.4K starsMay 28, 2026 pushdevopsShellIncident Response
$ npx skills add tclahr/uac#10
OPCDE Cybersecurity Conference Materials
621 starsAug 16, 2020 pushdevopsC++Incident Response
$ npx skills add msuiche/OPCDE#11
PagerDuty's Incident Response Documentation.
1.0K starsApr 9, 2026 pushdevopsDockerfileIncident Response
$ npx skills add PagerDuty/incident-response-docs#12
DFIRTrack - The Incident Response Tracking Application
536 starsJan 13, 2026 pushdevopsPythonIncident Response
$ npx skills add dfirtrack/dfirtrack#13
A collection of resources for Threat Hunters
915 starsOct 15, 2024 pushdevopsPythonIncident Response
$ npx skills add A3sal0n/CyberThreatHunting#14
Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...
1.1K starsNov 8, 2025 pushdevopsIncident ResponseClaude Code
$ npx skills add mdecrevoisier/Microsoft-eventlog-mindmap#15
FAME Automates Malware Evaluation
941 starsJun 13, 2026 pushdevopsPythonIncident Response
$ npx skills add certsocietegenerale/fame#16
A knowledge base of actionable Incident Response techniques
666 starsMay 31, 2022 pushdevopsPythonIncident Response
$ npx skills add atc-project/atc-reactHow to choose
When should you switch?
Use an alternative when it has a clearer install path, higher trust score, fresher maintenance, or better platform fit for your current agent stack. Keep Dfir Orc if it already passes your workflow test and repository review.
Next step
Compare top candidates side by side
Open the compare page, test the install commands in a sandbox, and check each repository before using a skill in production.