sleuthkit Web
https://www.sleuthkit.org/
The Sleuth Kit (disk forensics)
How to use it
Command-line tools (also via Autopsy GUI) to examine disk images: recover deleted files, build timelines, inspect filesystems.
Open resource →
SleuthKitLabs GitHub
https://github.com/SleuthKitLabs/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
volatility3 GitHub
https://github.com/volatilityfoundation/volatility3/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
velociraptor GitHub
https://github.com/Velocidex/velociraptor/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
velociraptor Web
https://docs.velociraptor.app/
Velociraptor docs
How to use it
Learn VQL and artifact writing for endpoint hunting.
timesketch Web
https://timesketch.org/
Timesketch (timeline analysis)
How to use it
Upload plaso timelines to collaboratively explore, annotate and visualize forensic events.
timesketch GitHub
https://github.com/google/timesketch/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
plaso GitHub
https://github.com/log2timeline/plaso/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
github Web
https://ericzimmerman.github.io/
Eric Zimmerman's tools
How to use it
Industry-standard Windows forensics utilities (MFTECmd, EvtxECmd, KAPE) — download, read the docs, run against triage collections.
KapeFiles GitHub
https://github.com/EricZimmerman/KapeFiles/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
github Web
https://ericzimmerman.github.io/KapeDocs/
Eric Zimmerman's tools
How to use it
Industry-standard Windows forensics utilities (MFTECmd, EvtxECmd, KAPE) — download, read the docs, run against triage collections.
wireshark Web
https://www.wireshark.org/
Wireshark packet analyzer
How to use it
Capture or open a pcap, then use display filters (e.g., http, dns, ip.addr==) to reconstruct network activity.
tcpdump Web
https://www.tcpdump.org/
tcpdump
How to use it
Command-line packet capture: `tcpdump -i eth0 -w capture.pcap` on servers, analyze later in Wireshark.
securityonionsolutions Web
https://securityonionsolutions.com/
Security Onion
How to use it
Free network-security-monitoring distro bundling Zeek, Suricata and Elastic — deploy a VM to monitor network traffic end-to-end.
securityonion GitHub
https://github.com/Security-Onion-Solutions/securityonion/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
zeek Web
https://zeek.org/
Zeek network monitor
How to use it
Passively converts network traffic into rich logs (conn, dns, http) for hunting and forensics.
zeek GitHub
https://github.com/zeek/zeek/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
suricata Web
https://suricata.io/
Suricata IDS/IPS
How to use it
High-performance intrusion detection with community rulesets (ET Open) to alert on malicious traffic.
suricata GitHub
https://github.com/OISF/suricata/
Open-source code repository
How to use it
Open the repo page, read the README for install instructions (usually a git clone or pip install command), then run it in a terminal. Check the 'Issues' and 'Releases' tabs for updates.
arkime Web
https://arkime.com/
Arkime full packet capture
How to use it
Indexes and stores full pcaps at scale with a powerful search UI for retrospective analysis.
wazuh Web
https://wazuh.com/
Wazuh XDR/SIEM
How to use it
Open-source security platform: deploy the manager + agents for log analysis, FIM and vulnerability detection.
snort Web
https://www.snort.org/
Snort IDS
How to use it
The original open-source IDS; write or download rules to detect attack patterns in traffic.