How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o
Volatility is a memory forensics framework and digital forensics tool designed to extract and analyze evidence from volatile computer memory dumps. It functions as a memory dump parser and analysis platform used to identify running processes, network connections, and loaded modules from a system RAM capture. The framework enables the reconstruction of system state to uncover malicious activity, such as rootkits and injected code, during malware incident response and threat hunting. It provides capabilities for digital forensic investigations to detect unauthorized access and indicators of com
This project provides a collection of architectural guidelines and operational standards for building secure, maintainable, and scalable server-side software systems. It establishes a framework for implementing consistent development environments, system observability, and data security practices across distributed application environments. The repository focuses on standardizing software engineering conventions to ensure environment parity and system transparency. It covers the implementation of aggregated health monitoring, request throttling, and secure data handling, including the use of
Santa is a binary authorization system for macOS designed to control and monitor which binaries can execute based on defined trust rules. It functions as application whitelisting software that prevents unauthorized programs from running by verifying them against cryptographic hashes and signing certificates. The system provides execution monitoring by recording every binary launch event to create a visible software execution trail. It enables centralized audit logging to track successful and denied application launches across multiple devices, ensuring enterprise device compliance through syn
The file provided should function as a great starting point for system monitoring in a self-contained package. This configuration and results should give you a good idea of what's possible for Sysmon. Please beware that you may need to fine tune and add exclusions depending on your environment.…
The main features of ion-storm/sysmon-config are: System Monitoring and Auditing, Threat Hunting Tools.
Projects with overlapping indexed features include: velocidex/velociraptor — Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and… volatilityfoundation/volatility — Volatility is a memory forensics framework and digital forensics tool designed to extract and analyze evidence from… futurice/backend-best-practices — This project provides a collection of architectural guidelines and operational standards for building secure,… google/santa — Santa is a binary authorization system for macOS designed to control and monitor which binaries can execute based on… nvisosecurity/evtx-hunter — evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files. nshalabi/sysmontools — Utilities for Sysmon.