dfir

Read-only MBR/GPT inspection, public file signature definitions, and synthetic disk image tools. AGPL-3.0-only.

Automate the creation of a lab environment complete with security tooling and logging best practices

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

CLI toolkit for email phishing analysis. Parses .eml files, runs heuristic checks on headers, links, and attachments, and outputs structured JSON.

Agentic DFIR