Open-source alternatives to RdpCacheStitcher

Hayabusa is a Windows event log analyzer, threat hunting tool, and forensic timeline generator. It functions as a detection engine that applies threat patterns to logs to identify suspicious behavior and security threats. The project distinguishes itself through the ability to synchronize detection rules from remote repositories and tune risk levels to prioritize critical alerts. It also provides specialized forensic capabilities, such as extracting event log data into chronological records for incident response investigations. The tool's broader capabilities include security log enrichment

PowerForensics provides an all in one platform for live disk forensic analysis

SRUM-DUMP extracts data from the System Resource Utilization Management (SRUM) database and generates an Excel spreadsheet. This tool is invaluable for forensic investigations, as SRUM maintains records of applications that have run on a system within the last 30 days.

AVML - Acquire Volatile Memory for Linux

WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.

This repository contains the configuration and support files for the SOF-ELK® VM Appliance.

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

Digital Forensics Investigation Platform

Digital Forensics artifact repository

Rekall Memory Forensic Framework

Collaborative forensic timeline analysis

LogonTracer is a security auditing tool designed for logon analysis and forensic log auditing. It functions as a dockerized security auditor that utilizes a security event graph database to map account names and network addresses, allowing for the visualization of complex system compromise patterns and authentication paths. The system features a Sigma detection engine that scans imported event logs against standardized rule sets to identify known malicious activity. It also includes an anomalous behavior detector that applies statistical analysis, graph algorithms, and hidden Markov models to

Super timeline all the things

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

This project is a terminal-based log analyzer and real-time traffic monitoring system designed for web server environments. It processes raw server access logs to generate structured statistical insights, providing visibility into visitor behavior, bandwidth usage, and request latency. The tool functions as a high-performance utility capable of handling large-scale datasets through multi-threaded parsing and memory-efficient data structures. The software distinguishes itself by offering both an interactive terminal interface and a web-based dashboard that updates in real-time via WebSocket st

Stretto is a Rust implementation for Dgraph's ristretto (https://github.com/dgraph-io/ristretto). A high performance memory-bound Rust cache.

A security analysis tool that identifies DNS queries made by browser extensions, empowering security teams to detect and investigate suspicious activities.

Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho

Erlang with SQL, inspired by yesql.

QSP is enhanced Erlang query string parser, that supports nested arrays, hashes and returns maps. Requires Erlang 17.0 and better. Extracted from Plug.

memcache client for rust