Incident Response - DFIRVault

Featured, Incident Response, Threat Hunting, Tooling and Software

November 6, 2025

FivePM – Threat Hunter

It’s 4:55 PM. You’re done for the day. Then — *ping* — “Possible compromise.” Meet **FivePM**: the open-source DFIR triage tool that turns chaos into clarity before you leave the office. - **Scans** files...

Incident Response, Threat Hunting, Tooling and Software

September 24, 2025

CrowdStrike Investigator

I’ve just released a new tool: CrowdStrike AID Timeliner.This script helps investigators quickly build timelines around CrowdStrike Alert IDs (AIDs). Instead of manually pulling data and stitching it together, the tool automates the process...

Incident Response, Tooling and Software, Windows Forensics

August 20, 2025

Hayabusa Scanner Menu

Streamlining Windows Event Log Analysis with My Hayabusa Scanner Menu ToolFor many DFIR analysts, hunting through Windows event logs (.evtx files) is a daily reality. While Hayabusa is already a powerful and fast timeline...

Incident Response, LLM / AI, Tooling and Software

June 23, 2025

Connecting Splunk with LLM

Why Use LLMs for DFIR in Splunk?As DFIR professionals, we deal with massive volumes of logs—security events, network traffic, endpoint telemetry, and more. While Splunk’s SPL (Search Processing Language) is powerful, what if we...

Incident Response, Threat Hunting, Tooling and Software

June 12, 2025

Splunk DFIR Dashboard Collection

Digital Forensics and Incident Response (DFIR) professionals know that speed and efficiency are critical during investigations. The Splunk DFIR Dashboard Collection is a treasure trove of ready-to-use Splunk dashboards designed to streamline forensic analysis and provide...

Cloud Forensics, Incident Response, Threat Hunting, Tooling and Software, Windows Forensics

May 21, 2025

ForensIQ

Introducing ForensIQ: AI-Powered Elasticsearch Log Analysis for Cybersecurity Investigations The Challenge of Modern Log Analysis As cybersecurity professionals, we know that logs are the lifeblood of incident response and threat hunting. But with the...

Cloud Forensics, Incident Response, Threat Hunting, Tooling and Software

May 21, 2025

CSV2ELK

Why I Built ThisAs a DFIR professional, I constantly deal with:CSV exports from SIEMs, firewalls, and malware analysis toolsTime wasted manually mapping fields to ElasticsearchCredential fatigue from repeated Elasticsearch loginsCSV2ELK v0.1 solves this with:✅ One-click ingestion of forensic data into...

FivePM – Threat Hunter

CrowdStrike Investigator

Hayabusa Scanner Menu

Connecting Splunk with LLM

Splunk DFIR Dashboard Collection

ForensIQ

CSV2ELK

Navigation

Categories