GRR is a distributed incident response platform and asynchronous forensic task orchestrator. It functions as a remote forensics framework designed to collect and analyze volatile data, system memory, and digital artifacts from remote hosts during security incident response. The system operates as a remote endpoint triage system, utilizing a coordinated architecture to manage a fleet of agents. It enables the execution of investigative tasks across multiple systems, allowing for the search of files and registries across a large fleet of machines to identify compromised hosts. The platform pro
Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o
Dispatch is an incident response orchestration platform that automates the coordination of detection, participant assembly, and task tracking across existing communication and project management tools. It provides a web-configurable state machine to manage incident lifecycle transitions, with template-driven incident models that define types, priorities, and severity levels. The platform enforces role-based access control to map user roles to specific actions and data access, while maintaining a database-backed audit trail of all incident events and system changes for compliance and post-incid
DEPRECATED - MozDef: Mozilla Enterprise Defense Platform
Las características principales de mozilla/mozdef son: Forensics and Incident Response, Incident Response Platforms, Alerting Tools, Hunting Tools, Offensive Security Tools, Security And Forensics, Threat Hunting Operations.
Las alternativas de código abierto para mozilla/mozdef incluyen: google/grr — GRR is a distributed incident response platform and asynchronous forensic task orchestrator. It functions as a remote… velocidex/velociraptor — Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and… netflix/dispatch — Dispatch is an incident response orchestration platform that automates the coordination of detection, participant… invoke-ir/powerforensics — PowerForensics provides an all in one platform for live disk forensic analysis. dfir-iris/iris-web. cyb3rward0g/helk — HELK is a containerized security information and event management environment and threat hunting platform. It provides…