Open source incident-response projects
Every project in the registry tagged incident-response, ranked by real GitHub adoption.
Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and hu
Comprehensive monitoring and incident management platform
Open source security automation platform for builders
SRE Agent - CNCF Sandbox Project
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-host
MasterParser is a powerful DFIR tool designed for analyzing and parsing Linux logs
Related tags
Frequently asked questions
How many open source incident-response projects are there?
This registry tracks 7 projects tagged incident-response, with 52,430 GitHub stars between them. The most-adopted is witr at 22,374 stars.
Are these incident-response projects free to use?
Yes — 7 of the 7 carry an explicit open-source licence across 3 distinct licences, so there is no licence fee. Where a project also sells a hosted or enterprise version, the self-hosted path remains free.
Which incident-response project should I choose?
The list above is ranked by GitHub stars, but stars measure attention rather than fit. Check three things on each card: the licence (permissive versus copyleft), the language it is written in, and the last-push date — a high-star project that has not been pushed in a year is a liability.
Are these incident-response projects still maintained?
6 of the 7 were pushed in the last 90 days, and every card shows its exact last-push date so you can see the rest. Sort your shortlist by that date before committing to a migration.