{"repo":"maxspl/OSIR","free":true,"listed":false,"github":"https://github.com/maxspl/OSIR","clone":"git clone https://github.com/maxspl/OSIR.git","description":"Orchestration Software for Incident Response","language":"Python","stars":16,"topics":["dfir","dfir-automation","dfir-orc","forensics","incident-response","kape","linux","orchestration","triage","windows"],"license":"Apache-2.0","category":"workflow-automation","readme_excerpt":"OSIR OSIR is a Python project designed for the automated processing of data using modules and profiles. It is primarily aimed at handling forensic artifacts but can be utilized for any type of files. OSIR acts as a scheduler, applying processing tools to files, where the output of some tools can serve as input to others. OSIR is a dockerized and distributed parsing framework that works on Linux and Windows. The current project supports multiple triage outputs like DFIR ORC and UAC. Table of Contents - Architecture - How does it work ? - Quick Start - Contributing - Main features - Documentation - Currently supported modules - Creators - License Architecture OSIR can be deployed in several ways, and each component can be externalized. Here's the default “all in one” configuration: How does it work ? The goal of the tool is to transform input files using processors: each processor is a module (decompress archive, convert file to json, SIEM ingestion ...) Modules are yml files that specify: - input (file or directory) based on its file/directory path and/or name - output : no file (ex: SIEM ingestion), single or multiple files - tool used and its command line : Windows or Linux tool, can even be a Python module - and other options to discover in the documentation The tool itself is launched with 2 inputs: - a case : directory containing files to process, can containg multiple triages (Windows triages of several endpoints for example) - list of modules used to process the input f","default_branch":null,"files":null,"tree":[],"storefront":"/r/maxspl","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/maxspl/OSIR/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}