meirwah/awesome-incident-response

Awesome Incident Response is a curated list of tools and resources for Digital Forensics and Incident Response, a field commonly abbreviated as DFIR. When an organization discovers a potential security breach, DFIR teams are responsible for investigating what happened, collecting evidence, containing the damage, and putting controls in place to prevent recurrence. This list aims to give those teams a starting point for finding the right software. The list is organized into more than twenty categories. These include tools for making copies of disk images, collecting evidence from live systems, analyzing memory snapshots, parsing and searching log files, building timelines of events, and running suspicious files inside sandboxes. There are separate sections for tools specific to Linux, macOS, and Windows evidence collection. A category called adversary emulation covers tools for simulating attacker behavior in a controlled environment, which teams use to test their own detection and response capabilities. There is also a smaller set of all-in-one platforms that combine multiple forensic and case management functions into a single interface, such as GRR Rapid Response for remote live forensics and IRIS, a web-based platform for sharing investigations among analysts. Most entries are links to open-source projects on GitHub with a one-line description. Some entries point to commercial tools. A short reading list of books and a video section for learning DFIR concepts are also included. The list follows the standard awesome-list README format, which means it is easy to browse but does not include ratings or last-maintained dates. Links are checked for validity automatically via a GitHub Actions workflow. The full README is longer than what was shown.