Linux Evidence Acquisition Framework
-
Updated
Sep 30, 2024 - Python
#
linux-forensics
Here are 11 public repositories matching this topic...
A comprehensive repository for CyberOps documentation, Blue Team playbooks, and open-source forensic tools like Cerberus and Chimera.
powershell incident-response forensics dfir cybersecurity threat-hunting digital-forensics triage blueteam memory-forensics security-tools threat-detection live-response windows-forensics memory-acquisition linux-forensics kusto-query incident-response-tool
-
Updated
Oct 20, 2026 - Python
A memory forensics automation tool that wraps Volatility 3, runs plugins, detects suspicious activity (malicious processes, code injection, network anomalies), and generates professional reports from a single command. Supports Windows, Linux, and macOS.
automation incident-response dfir cybersecurity threat-hunting malware-analysis digital-forensics volatility forensic-analysis memory-forensics security-tools malware-detection blue-team threat-detection soc-tools volatility3 windows-forensics linux-forensics python-forensics
-
Updated
Aug 18, 2026 - Python
Evidence-preserving digital forensics primitives and composable workflows for analysts, automation systems, and autonomous agents.
python cli security toolkit network-forensics incident-response forensics dfir digital-forensics windows-forensics linux-forensics android-forensics agent-tools
-
Updated
Oct 18, 2026 - Python
AI-native MCP server for natural-language cyber incident investigation and triage across Windows, Linux, and macOS artifacts, plus Volatility3 memory forensics and Hashcat. Mount evidence, parse artifacts, trace lateral movement, correlate IOCs, and generate reports through conversation.
mcp incident-response forensics dfir cybersecurity threat-hunting digital-forensics memory-forensics windows-forensics forensics-tools linux-forensics macos-forensics model-context-protocol memory-forensic
-
Updated
Sep 3, 2026 - Python
Digital forensics and incident response (DFIR) reference: evidence handling, memory/disk forensics workflows, and chain-of-custody procedures for enterprise investigations
python docker powershell network-forensics incident-response dfir cybersecurity infosec case-management digital-forensics soc forensic-analysis memory-forensics timeline-analysis chain-of-custody pcap-analysis windows-forensics linux-forensics macos-forensics evidence-handling
-
Updated
Jul 12, 2026 - Python
Local, offline, LLM-assisted forensic triage for Linux server images: established DFIR tools do detection; Gumshoe adds provenance, chain of custody, a cited RAG layer, evidence archive/export and reports.
offline incident-response uac mariadb forensics dfir loki digital-forensics sigma yara chainsaw evidence rag air-gapped aapanel chain-of-custody llm linux-forensics local-llm ollama
-
Updated
Oct 24, 2026 - Python
Parse syslog/auth.log for auth failures and sudo abuse — Linux log forensics and server intrusion investigation offline.
python incident-response syslog forensics dfir cybersecurity threat-hunting digital-forensics security-tools blue-team linux-forensics offline-security
-
Updated
Sep 2, 2026 - Python
SSH Authentication Incident Investigation & Forensics Lab with Kali Linux attack replay, Linux auth.log triage, Wireshark PCAP packet extraction, and brute-force forensic report.
log-analysis pcap wireshark kali-linux linux-forensics soc-analyst brute-force-detection ssh-investigation
-
Updated
Oct 10, 2026 - Python
Forensic artifacts at a glance, built from ten years of collected notes: what they are, what they prove, where to find them, with references and free tools. Windows, macOS, iOS, Android, Linux and more.
dfir knowledge-base digital-forensics mobile-forensics windows-forensics linux-forensics macos-forensics ios-forensics android-forensics
-
Updated
Oct 25, 2026 - Python
Ongoing DFIR-focused Hack The Box write-ups highlighting my investigative methodology and forensic analysis.
-
Updated
Oct 3, 2026 - Python
Add this topic to your repo
To associate your repository with the linux-forensics topic, visit your repo's landing page and select "manage topics."