Phil Hagen

sof-elk. Configuration files for the SOF-ELK VM

ip2geo. Script to perform bulk local GeoIP lookups (ASN and geo) for IP addresses

for572-scripts. A completely unsupported set of scripts used in SANS FOR572, Advanced Network Forensics and Analysis

vmware-snapcompare. VMware Snapshot Forensic Comparison Scripts

timeshift. A python script to shift the timestamp on syslog data. Useful for forensicators combating time skew.

ltc-fuzzy-keyword-suggestions. YOURLS plugin to alleviate typos in short URLs

geoip-bootstraps. Shell

Cybersecurity-Pathfinders.

passivedns. A network sniffer that logs all DNS server replies for use in a passive DNS setup

web-traffic-generator. A quick and dirty HTTP/S "organic" traffic generator.

sansfor509. Public script from SANS FOR509 Enterprise Cloud Incident Response

hassh. HASSH is a network fingerprinting standard which can be used to identify specific Client and Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of a small MD5 fingerprint.

fail2ban. Daemon to ban hosts that cause multiple authentication errors

daylight_tracker. Python

ja3-aggregator. Aggregate and normalize JA3 hash databases from multiple sources

freq. This is a repository for freq.py and freq_server.py

sift-bootstrap. SANS Investigative Forensics Toolkit Bootstrap Script

arkime. Arkime (formerly Moloch) is an open source, large scale, full packet capturing, indexing, and database system.

yersinia-web. Yersinia Web

arkimeweb. The website for arkime.com

pptxindex. Create a MS Word index file from PowerPoint notes and slides