Linux Evidence Acquisition Framework
-
Updated
Sep 30, 2024 - Python
#
linux-forensics
Here are 9 public repositories matching this topic...
A memory forensics automation tool that wraps Volatility 3, runs plugins, detects suspicious activity (malicious processes, code injection, network anomalies), and generates professional reports from a single command. Supports Windows, Linux, and macOS.
automation incident-response dfir cybersecurity threat-hunting malware-analysis digital-forensics volatility forensic-analysis memory-forensics security-tools malware-detection blue-team threat-detection soc-tools volatility3 windows-forensics linux-forensics python-forensics
-
Updated
Aug 18, 2026 - Python
Evidence-preserving digital forensics primitives and composable workflows for analysts, automation systems, and autonomous agents.
python cli security toolkit network-forensics incident-response forensics dfir digital-forensics windows-forensics linux-forensics android-forensics agent-tools
-
Updated
Oct 12, 2026 - Python
Digital forensics and incident response (DFIR) reference: evidence handling, memory/disk forensics workflows, and chain-of-custody procedures for enterprise investigations
python docker powershell network-forensics incident-response dfir cybersecurity infosec case-management digital-forensics soc forensic-analysis memory-forensics timeline-analysis chain-of-custody pcap-analysis windows-forensics linux-forensics macos-forensics evidence-handling
-
Updated
Jul 12, 2026 - Python
AI-native MCP server for natural-language cyber incident investigation and triage across Windows, Linux, and macOS artifacts, plus Volatility3 memory forensics and Hashcat. Mount evidence, parse artifacts, trace lateral movement, correlate IOCs, and generate reports through conversation.
mcp incident-response forensics dfir cybersecurity threat-hunting digital-forensics memory-forensics windows-forensics forensics-tools linux-forensics macos-forensics model-context-protocol memory-forensic
-
Updated
Sep 3, 2026 - Python
Local, offline, LLM-assisted forensic triage for Linux server images: established DFIR tools do detection; Gumshoe adds provenance, chain of custody, a cited RAG layer, evidence archive/export and reports.
offline incident-response uac mariadb forensics dfir loki digital-forensics sigma yara chainsaw evidence rag air-gapped aapanel chain-of-custody llm linux-forensics local-llm ollama
-
Updated
Oct 13, 2026 - Python
SSH Authentication Incident Investigation & Forensics Lab with Kali Linux attack replay, Linux auth.log triage, Wireshark PCAP packet extraction, and brute-force forensic report.
log-analysis pcap wireshark kali-linux linux-forensics soc-analyst brute-force-detection ssh-investigation
-
Updated
Oct 10, 2026 - Python
Parse syslog/auth.log for auth failures and sudo abuse — Linux log forensics and server intrusion investigation offline.
python incident-response syslog forensics dfir cybersecurity threat-hunting digital-forensics security-tools blue-team linux-forensics offline-security
-
Updated
Sep 2, 2026 - Python
Ongoing DFIR-focused Hack The Box write-ups highlighting my investigative methodology and forensic analysis.
-
Updated
Oct 3, 2026 - Python
Add this topic to your repo
To associate your repository with the linux-forensics topic, visit your repo's landing page and select "manage topics."