Query and report user logons relations from MS Windows Security Events
This repository contains helper scripts and custom configs to get the best out of Google's Timesketch project.
Autonomous DFIR agent: point it at disk images, memory dumps or log exports and get back an investigation that shows its work. Volatility 3, Plaso, YARA and any OpenAI-compatible LLM.
Pipeline that allows sending forensic artifacts to OpenRelik for automatic processing
An open source project aimed to replicate the Windows SIFT Machine and tools used during SANS Courses minus any payware software.
Forensic analysis of disk images, smartphone extractions (iPhone, Android) and drone flight logs, with an optional local, offline AI assistant. Sleuth Kit, plaso, libyal, iLEAPP/ALEAPP. Windows, Mac, Linux.
A collection of custom-built dashboards for threat hunting.
Yomi is engineered to operate on a fundamentally faster timeline. By orchestrating SANS SIFT Workstation forensic tools through a strict, type-safe Model Context Protocol (MCP) server and evaluating evidence via a cascading Epistemic Doubt Engine, Yomi achieves a Time-to-Containment (TTC) of < 5 seconds.
Docker for the latest Plaso version https://github.com/log2timeline/plaso
An AI-assisted DFIR tool designed to tame the timeline deluge. It leverages ML to triage anomalies and local LLMs to reconstruct high-level events, allowing investigators to query evidence with strict forensic soundness and 100% traceability to the source artifacts.
Plaso Log2timeline automation script for easier OS forensics timeline analysis
Forensic timeline reconstruction from GUID-less artefacts: calibrated causal rules, confidence-graded incident stories and SHA-256 custody (Sysmon/EVTX, plaso, Volatility, auth.log, auditd). Lab-only DFIR.
Parse IIS W3C logs without dropping malformed-looking requests, and account for every line that does not become an event.
To associate your repository with the plaso topic, visit your repo's landing page and select "manage topics."