データ収集・分析
ロングテール分析(ニッチな事象を分析)による外れ値や異常な活動を特定
ライブリモートメモリフォレンジック
ファイルシステムデータの検索と操作
システム情報の照会
ディスクスキャン
メモリスキャン・ダンプ
ブラウザ履歴の収集
Kansa
A modular incident response framework in Powershell.
It uses Powershell Remoting to run user contributed, ahem, user contri-
buted modules across hosts in an enterprise to collect data for use
during incident response, breach hunts, or for building an environmental
baseline.
TheHive
TheHive is a scalable 3-in-1 open source and free Security Incident Response Platform designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly.
GRR Rapid Response
GRR Rapid Response is an incident response framework focused on remote live forensics.
GRR is a python client (agent) that is installed on target systems, and python server infrastructure that can manage and talk to clients.
enable remote live in-memory analysis.
Velociraptor
Endpoint visibility and collection tool.
Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.
Fenrir
Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise (IOCs): Hashes, File Names, Strings, C2 Server, Hot Time Frame
OSSEC
OSSEC is a multiplatform, open source and free Host Intrusion Detection System (HIDS).
You can tailor OSSEC for your security needs through its extensive configuration options, adding custom alert rules and writing scripts.
Wazuh
Wazuh is a free and open source platform used for threat prevention, detection, and response.
It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments.
Wazuh solution consists of an endpoint security agent, deployed to the monitored systems, and a management server, which collects and analyzes data gathered by the agents.
Besides, Wazuh has been fully integrated with the Elastic Stack, providing a search engine and data visualization tool that allows users to navigate through their security alerts.