DFIR - DFIRVault

Incident Response, Threat Hunting, Tooling and Software

September 24, 2025

CrowdStrike Investigator

I’ve just released a new tool: CrowdStrike AID Timeliner.This script helps investigators quickly build timelines around CrowdStrike Alert IDs (AIDs). Instead of manually pulling data and stitching it together, the tool automates the process...

Incident Response, Tooling and Software, Windows Forensics

August 20, 2025

Hayabusa Scanner Menu

Streamlining Windows Event Log Analysis with My Hayabusa Scanner Menu ToolFor many DFIR analysts, hunting through Windows event logs (.evtx files) is a daily reality. While Hayabusa is already a powerful and fast timeline...

Tooling and Software, Windows Forensics

August 19, 2025

Automating Windows Event Log Analysis with Chainsaw Event Log Scanner

As a cybersecurity enthusiast, I’m always exploring ways to streamline digital forensics and incident response workflows. Recently, I developed a tool to make scanning Windows Event Logs (EVTX files) easier and more efficient. Introducing...

Tooling and Software

August 4, 2025

Splunk DFIR Case Manager

Why I Built This ToolAs a cybersecurity professional, I frequently work with Splunk for log management, threat detection, and incident response. One challenge I faced was managing indexes efficiently—whether creating new ones, deleting old ones, or backing...

Tooling and Software

June 21, 2025

DFIR Case Manager

📁 DFIR Case Manager – Simple Case Workflow in a ClickManaging forensic case folders shouldn't be a chore. That’s why I built DFIR Case Manager, a no-frills batch utility that automates your case structure...

Threat Hunting, Tooling and Software

May 22, 2025

AI-Assisted Hunting: Ollama Meets ELK

When we work with a large amount of logs, sometimes millions or billions of events need to be parsed and queried to find the needle in the haystack. I've recently begun looking in to...

Cloud Forensics, Incident Response, Threat Hunting, Tooling and Software

May 21, 2025

CSV2ELK

Why I Built ThisAs a DFIR professional, I constantly deal with:CSV exports from SIEMs, firewalls, and malware analysis toolsTime wasted manually mapping fields to ElasticsearchCredential fatigue from repeated Elasticsearch loginsCSV2ELK v0.1 solves this with:✅ One-click ingestion of forensic data into...

CrowdStrike Investigator

Hayabusa Scanner Menu

Automating Windows Event Log Analysis with Chainsaw Event Log Scanner

Splunk DFIR Case Manager

DFIR Case Manager

AI-Assisted Hunting: Ollama Meets ELK

CSV2ELK

Navigation

Categories