google/grr

Features

• Digital Forensics and Incident Response Platforms - Provides a comprehensive platform for hunting indicators of compromise, analyzing disk images, and performing remote triage.
• Forensic Artifact Collection - Captures specific binaries, memory dumps, and network traffic from remote targets for security investigation.
• Raw Disk Analysis - Uses forensic toolkits to access OS-level data and recover information directly from physical disks.
• Endpoint Agent Control - Executes investigative tasks from a central server to manage client agents across a fleet of systems.
• Forensic Event Timelines - Constructs a chronological sequence of events to reconstruct the activity of an attacker or a specific process.
• Execution Timeline Reconstruction - Synthesizes disparate forensic artifacts into a chronological history of process executions to reconstruct attacker activity.
• Direct Underlying Filesystem Accesses - Provides direct access to underlying physical filesystems to recover data independently of the operating system's file APIs.
• Fleet-Wide File and Registry Search - Locates and downloads specific files or registry keys across a single host or a large fleet of machines.
• Distributed Task Agents - Utilizes a central controller to dispatch investigative tasks to lightweight agents deployed on remote target hosts.
• Distributed Artifact Collection - Aggregates volatile memory and file system data from multiple remote targets into a centralized analysis stream.
• Incident Response Triage - Provides rapid search capabilities for files and registry keys across a large fleet to identify compromised hosts.
• Remote Endpoint Triage - Provides a centralized server for gathering system memory and forensic evidence from remote targets.
• Digital Forensics and Analysis - Enables deep-dive investigation of active operating systems through raw file system analysis and event timeline generation.
• System Forensic Analysis - Collects memory dumps and audit trails to investigate security incidents and analyze attacker interaction with hosts.
• Forensic Data Aggregators - Aggregates volatile memory and file system data from multiple remote targets into a centralized analysis stream.
• Distributed Recurring Task Scheduling - Automates the execution of recurring forensic jobs across a distributed fleet using a cron-like schedule.
• Fleet Security Compliance Monitoring - Tracks resource usage and executes recurring forensic checks across many systems to ensure security compliance.
• Forensic Task Orchestration - Implements a non-blocking message processing system to schedule and execute forensic jobs across a fleet of targets.
• Message Queuing Architectures - Implements a message queuing architecture to decouple the scheduling of forensic tasks from their execution across a distributed fleet.
• Agent Resource Throttling - Monitors and throttles CPU and memory usage on target hosts to prevent forensic activity from impacting production services.
• System Usage Monitors - Reports real-time device metrics such as CPU and memory usage on target systems to ensure stability during forensics.
• Forensics and Incident Response - Distributed agent-based forensic and incident response framework.
• Live Forensics and Response - Remote live forensics framework for incident response.
• Incident Response Platforms - Framework for remote live forensics using Python agents.
• Defensive Security - Remote live forensics and incident response capabilities.
• Digital Forensics - Framework for remote live forensics and incident response.
• Forensics and Incident Response - Remote live forensics platform for enterprise environments.
• Hunting Tools - Incident response framework for remote live forensics.
• Live Forensics - Remote live forensics and incident response platform.
• Security And Forensics - Remote live forensics and browser-based attack triage.
• Threat Hunting Operations - Framework for remote live forensics and incident response.
• Threat Hunting Tools - Remote live forensics and incident response platform.

Star history