# Incident Response

Incident response tools, and resources when alarms pop off.

# Active Directory

• LogonTracer - Investigate malicious Windows logon by visualizing and analyzing Windows event log.

# Management Platform

• DFIRTrack - The Incident Response Tracking Application.
• FIR - Fast Incident Response allows for easy creation, tracking, and reporting of cybersecurity incidents.
• The Hive - A Scalable, Open Source and Free Security Incident Response Platform.
• Wazuh - Capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments.

# Reporting

• Cortex - Powerful Observable Analysis and Active Response Engine.
• Response - Real-time incident response and reporting tool.
• Velociraptor - A tool for collecting host based state information using Velocidex Query Language (VQL) queries.

# Active Directory

• LogonTracer - Investigate malicious Windows logon by visualizing and analyzing Windows event log.

# Management Platform

• DFIRTrack - The Incident Response Tracking Application.
• FIR - Fast Incident Response allows for easy creation, tracking, and reporting of cybersecurity incidents.
• The Hive - A Scalable, Open Source and Free Security Incident Response Platform.
• Wazuh - Capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments.

# Reporting

• Cortex - Powerful Observable Analysis and Active Response Engine.
• Response - Real-time incident response and reporting tool.
• Velociraptor - A tool for collecting host based state information using Velocidex Query Language (VQL) queries.