Open source incident-response projects
Every project in the registry tagged incident-response, ranked by real GitHub adoption.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud
Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and hu
Comprehensive monitoring and incident management platform
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-host
Open source security automation platform for builders
SRE Agent - CNCF Sandbox Project
An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it — right from Slack, Telegram, Lark or DingTalk.
Tenzir is the data pipeline engine for security teams.
MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
Plugins for Wazuh Dashboard
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
Related tags
Frequently asked questions
How many open source incident-response projects are there?
This registry tracks 14 projects tagged incident-response, with 97,255 GitHub stars between them. The most-adopted is Anthropic-Cybersecurity-Skills at 35,414 stars.
Are these incident-response projects free to use?
Yes — 13 of the 14 carry an explicit open-source licence across 5 distinct licences, so there is no licence fee. Where a project also sells a hosted or enterprise version, the self-hosted path remains free.
Which incident-response project should I choose?
The list above is ranked by GitHub stars, but stars measure attention rather than fit. Check three things on each card: the licence (permissive versus copyleft), the language it is written in, and the last-push date — a high-star project that has not been pushed in a year is a liability.
Are these incident-response projects still maintained?
12 of the 14 were pushed in the last 90 days, and every card shows its exact last-push date so you can see the rest. Sort your shortlist by that date before committing to a migration.