Yamato-Security/hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
A star delta has been computed for 61,707 of 62,629 tracked repositories in this period, and only those can be ranked in it.
A repository missing here has not been measured far enough back yet. That does not mean it did not move.
Star counts measured between 00:28 and 02:29 (BKK).
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
A repository of sysmon configuration modules
Local-first threat hunting for the logs you already have: Zeek, Pi-hole, syslog or the systemd journal, CloudTrail. Every run names the technique behind each detector. No agent, no daemon, no black box - between grep and a SIEM.
Rapidly Search and Hunt through Windows Forensic Artefacts
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Valhuntir CLI — AI-augmented incident response platform
Cortex Analyzers Repository
Read-only MBR/GPT inspection, public file signature definitions, and synthetic disk image tools. AGPL-3.0-only.
IntelOwl: manage your Threat Intelligence at scale
Wireless ADB, over the internet; not just local Wi-Fi. An encrypted, censorship-resistant mesh VPN making remote forensics and network monitoring seamless.
Collaborative forensic timeline analysis
Your Everyday Threat Intelligence
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
A cross platform forensic parser written in Rust!
Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.
A swarm of forensic agents, on your machine, on the record. Open-source agentic digital forensics and incident response under the AGPL: agents divide the case on a shared board, forge their own tools, and leave a hash-chained record.
macOS (& ios) Artifact Parsing Tool
Jevline: start from one confirmed-malicious process; Jev links the rest of the incident into a timeline, execution chain and evidence table.
Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.
a forensic carver with a soft heart · 基于 Rust、Tauri 2 与 Vue 3 的桌面磁盘取证与数据恢复工具：只读解析镜像、文件系统与加密卷，提供原类型预览、全局搜索、时间线、文件雕刻与插件分析
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
🐍 High-performance, multi-threaded YARA & IOC scanner
That's all 24 repositories in this period.
