incident-response

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

A curated list of Site Reliability and Production Engineering resources.

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)

A curated list of tools for incident response

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Complete open-source monitoring and observability platform.

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

IntelOwl: manage your Threat Intelligence at scale

✨ A curated list of awesome threat detection and hunting resources 🕵️‍♂️

Volatility 3.0 development

Tools and Techniques for Blue Team / Incident Response

Digging Deeper....

TheHive is a Cybersecurity Incident Response Management (CIRM) platform, now distributed commercially. Learn more on the official website:

Open-source security automation platform for teams and AI agents

SRE Agent - CNCF Sandbox Project

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.