The API traffic analyzer for Kubernetes providing real-time K8s protocol-level visibility, capturing and monitoring all traffic and payloads going in, out and across containers, pods, nodes and clusters. Inspired by Wireshark, purposely built for Kubernetes

Digging Deeper....

Open Source Security Guide. Learn all about Security Standards (FIPS, CIS, FedRAMP, FISMA, etc.), Frameworks, Threat Models, Encryption, and Benchmarks.

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

Fast and efficient osquery management

Automatically capture and surface your team's tribal knowledge

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Incident Response - Fast suspicious file finder

simple YARA-based IOC scanner

Entropy scanner for Linux to detect packed or encrypted binaries related to malware. Finds malicious files and Linux processes and gives output with cryptographic hashes.

Shodan Monitoring integration for TheHive.

Yara-Endpoint is a tool useful for incident response as well as anti-malware enpoint base on Yara signatures.

Convert a variety of log formats to CSV while enriching detected IPs with Geolocation, ASN, DNS, WhoIs, Shodan InternetDB and Threat Indicator matches.

Incident Monitoring for the Lean and Mean ;)

An iOS backup extraction tool written in Golang

A tool for interacting with live processes/containers

Import data into the incident.io Catalog from a variety of sources.

Hikeshi is a security incident response application that keeps documenting incidents simple, so you can focus on fighting fires.

VTC - Velociraptor Timeline Creator

Helping Incident Responders hunt for potential persistence mechanisms on UNIX-based systems.