# DFIR tools

even with the awesome list all over github, I kept losing tracks of cool tools, so here are some of them:

(last update 11.09.2022)

in the spirit of keep updating the resources, I'm moving this post to [aldosimon/infosec-compendium](https://aldosimon.com/infosec-compendium)

#### event log parser

[chainsaw](https://github.com/WithSecureLabs/chainsaw) Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows event logs. It offers a generic and fast method of searching through event logs for keywords, and by identifying threats using built-in support for Sigma detection rules, and via custom Chainsaw detection rules.

[DeepBlueCLI](https://github.com/sans-blue-team/DeepBlueCLI) a PowerShell Module for Threat Hunting via Windows Event Logs

[logparser studio](https://techcommunity.microsoft.com/t5/exchange-team-blog/log-parser-studio-2-0-is-now-available/ba-p/593266) event viewer and other logs parsing with SQL Language interface

#### endpoint

[velociraptor](https://github.com/Velocidex/velociraptor) Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.

[osquery](https://osquery.io/) osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework.

[loki](https://github.com/Neo23x0/Loki) Loki - Simple IOC and YARA Scanner

[KAPE](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape) Kroll Artifact Parser And Extractor, lets forensic teams collect and process forensically useful artifacts within minutes.

#### all in one analysis

[autposy/ TSK](http://www.sleuthkit.org/) Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools

#### knowledge base, tutorial, cheatsheet, etc

[event ids](https://github.com/stuhli/awesome-event-ids) github event id awesome list

[mitre to evtx](https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack) MITRE mapping to event id

[lenny zeltser log cheatsheet](https://zeltser.com/media/docs/security-incident-log-review-checklist.pdf) IR critical log review cheatsheet

[lenny zeltser incident survey](https://zeltser.com/media/docs/security-incident-survey-cheat-sheet.pdf) Security incident survey cheat sheet for server administrators