Volatility3 alternatives for AI agents.

FAME Automates Malware Evaluation

Collaborative Incident Response platform

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.

Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

DFIRTrack - The Incident Response Tracking Application

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

A collection of resources for Threat Hunters

Digging Deeper....

A knowledge base of actionable Incident Response techniques

An opensource incident management platform integrating with Slack.

Cross-platform incident response and live forensics toolkit with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.