Discover the best Incident Response open source repositories on GitHub. Explore trending tools, live star counts, source code, and developer projects updated daily.
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
SRE Agent - CNCF Sandbox Project
Vigil SOC: The leading open source AI SOC. Apache 2.0. Runs against your own LLM, local or remote.
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
Tenzir is the data pipeline engine for security teams.
A curated list of tools for incident response. With repository stars⭐ and forks🍴
An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it — right from Slack, Telegram, Lark or DingTalk.
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
Awesome Security lists for SOC/CERT/CTI
Open-source security automation platform for teams and AI agents
An open source platform to support analysts to organise their case and tasks
An open‑source technical wiki connected to the systems it describes
OpenSRE — the memory-first AI SRE. Self-hosted incident investigation with episodic memory, knowledge graph, web console, Slack & Teams. opensre.in
An open-source security platform for the community. Unified SIEM, SOAR, WAF, and more in a single, self-hosted solution.
Learn platform engineering by breaking and fixing real Kubernetes clusters.
Local-first, explainable log incident diagnosis for developers and CI/CD.
The official incident.io Ruby SDK
STViewer is a viewer and search tool for email archives such as OST, PST, and mbox written in Rust. Runs on Windows, macOS and Linux