Query and report user logons relations from MS Windows Security Events
This repository contains helper scripts and custom configs to get the best out of Google's Timesketch project.
Pipeline that allows sending forensic artifacts to OpenRelik for automatic processing
An open source project aimed to replicate the Windows SIFT Machine and tools used during SANS Courses minus any payware software.
A collection of custom-built dashboards for threat hunting.
Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM. Source-available, free for personal use and for evaluation of up to 31 days.
Docker for the latest Plaso version https://github.com/log2timeline/plaso
Plaso Log2timeline automation script for easier OS forensics timeline analysis
Parse IIS W3C logs without dropping malformed-looking requests, and account for every line that does not become an event.
Forensic timeline reconstruction from GUID-less artefacts: calibrated causal rules, confidence-graded incident stories and SHA-256 custody (Sysmon/EVTX, plaso, Volatility, auth.log, auditd). Lab-only DFIR.
An AI-assisted DFIR tool designed to tame the timeline deluge. It leverages ML to triage anomalies and local LLMs to reconstruct high-level events, allowing investigators to query evidence with strict forensic soundness and 100% traceability to the source artifacts.
To associate your repository with the plaso topic, visit your repo's landing page and select "manage topics."