Every incident response engagement surfaces the same uncomfortable truth: teams that have not prepared their tooling before an incident spend the first critical hours sourcing, validating, and deploying software under pressure. That time is irreplaceable. The attacker is moving while you are downloading installers and checking hashes. Toolkit readiness is not a nice-to-have — it is a prerequisite for effective response.

The good news is that the open-source and free security community has produced a remarkable collection of production-quality IR tools. You do not need expensive commercial licenses to respond competently to most intrusion scenarios. What you do need is a curated, tested, and pre-staged toolkit organized around the phases of your response process — so that every responder knows exactly which tool to reach for and exactly where to find it.

This guide covers the essential free tools organized by IR phase: preparation, detection and triage, containment, forensic collection, analysis, and recovery. It concludes with practical guidance on organizing and maintaining the toolkit itself. The goal is a document your team can use to build and validate a ready-to-deploy IR toolkit today.

Why Toolkit Readiness Matters

Incident response is a time-compressed discipline. The longer an attacker remains in your environment, the more damage accumulates: more data exfiltrated, more systems compromised, more persistence mechanisms planted. The window in which response actions are most effective — before the attacker achieves their primary objective — is often measured in hours, not days.

Toolkit readiness shortens every phase of response. When an analyst does not have to search for a tool, validate its integrity, and figure out its syntax under pressure, they move faster and make fewer errors. When tools are pre-staged on IR jump kits and remote deployment packages, collection can begin immediately upon scope confirmation rather than after a logistics delay.

There is a second, less obvious reason toolkit readiness matters: legal and evidentiary integrity. Tools that are downloaded during an incident from unverified sources introduce chain-of-custody concerns. Tools that are pre-staged, version-controlled, and hash-verified are defensible in regulatory and legal proceedings. If your IR work feeds into breach notification, regulatory reporting, or litigation, provenance of your forensic tools matters.

Finally, toolkit readiness enables practice. Teams that maintain a working toolkit can run tabletop exercises, simulate collection workflows, and practice analysis on sample images. Teams that do not have a toolkit cannot practice effectively. The toolkit is infrastructure for continuous preparedness, not just an emergency resource.

Preparation Phase Tools

Preparation is everything you do before an incident to reduce the time and effort required to respond when one occurs. The tools in this phase are not typically used during active response — they build the foundations that make active response faster.

Asset Inventory and Baseline

Nmap remains the most versatile network discovery and asset enumeration tool available. During preparation, use it to build and maintain an accurate inventory of systems, open ports, and services. During an incident, the same tool lets you rapidly scope which systems may be involved. Pre-stage Nmap on your jump kit with a set of pre-written scan profiles for common scenarios: quick discovery, full port scan, service version detection, and OS fingerprinting.

osquery provides a SQL interface to operating system state — running processes, loaded modules, network connections, user accounts, scheduled tasks, and hundreds of other data sources. The real preparation value of osquery is endpoint baselining: deploy it across your estate, establish normal query results for each system class, and you have a reference point for anomaly detection during incidents. The osqueryi interactive shell is also invaluable for rapid live triage on individual systems during response.

Sysinternals Suite (Microsoft, free) is a non-negotiable component of any Windows IR toolkit. Autoruns for persistence enumeration, Process Explorer for detailed process inspection, Process Monitor for real-time file and registry activity, TCPView for network connections, and PsExec for remote command execution. Every component is signed by Microsoft, runs without installation, and provides capabilities not available through built-in Windows tooling. Keep the full suite on your jump kit, version-pinned and hash-verified.

Communication Platforms

Secure, out-of-band communication infrastructure is a preparation-phase requirement that is easy to overlook until you need it. If your primary communication channels run through systems that may be compromised — corporate email, Slack, Teams — an attacker monitoring those channels can track your response actions in real time. Pre-establish a secondary communication channel, verified before the incident, that runs independently of your primary corporate infrastructure. Signal, a dedicated incident response Slack workspace on a separate domain, or a secure conferencing platform provisioned for IR use are all acceptable options. The specific platform matters less than having it deployed, tested, and familiar to responders before they need it under pressure.

Detection and Triage Tools

Detection tools identify malicious activity. Triage tools quickly characterize the scope and nature of an incident during the first phase of response. The boundary between the two overlaps significantly in practice.

Sysmon

Sysmon (System Monitor, Microsoft Sysinternals) is a Windows system service that logs detailed process creation, network connection, file creation, registry modification, and driver loading events to the Windows Event Log. It operates below the application layer, making it significantly more difficult for malware to evade than user-mode logging solutions.

A well-tuned Sysmon configuration — the community configurations by SwiftOnSecurity and Olaf Hartong are excellent starting points — dramatically increases detection fidelity for common attacker techniques. During triage, Sysmon logs answer questions that the default Windows event log cannot: which process created a specific file, what network connections has a process made, and what was the full process creation chain that led to a suspicious executable running. Install Sysmon across all endpoints as a baseline preparation step, and ensure logs are forwarded to a SIEM or log aggregator that survives host compromise.

YARA

YARA is a pattern-matching engine designed for malware identification. You write rules that describe patterns — byte sequences, strings, structural characteristics of PE files — and YARA scans files, processes, or memory regions to find matches. The open-source YARA rule repositories (the Awesome YARA list maintained on GitHub) contain thousands of community rules covering known malware families, threat actor tooling, and generic suspicious patterns.

During triage, run YARA against suspicious files and memory dumps to quickly identify known-bad indicators. During preparation, build a curated ruleset tuned to your threat model and test it against clean baselines to eliminate false positives before you need it under pressure.

Sigma

Sigma is the detection rule standard for SIEM and log analysis. Where YARA operates on files and memory, Sigma operates on log data. Sigma rules describe detection logic in a generic format that can be converted to the query language of any supported SIEM: Splunk, Elastic, Microsoft Sentinel, Chronicle, and others. The Sigma repository on GitHub contains thousands of community-contributed rules covering ATT&CK techniques, threat actor behavior patterns, and common attacker tools.

The preparation value of Sigma is building a detection library that is portable across tooling changes. During triage, Sigma-converted queries run against your SIEM to rapidly surface activity patterns matching known attack techniques. The sigma-cli tool handles conversion and can be scripted to maintain an up-to-date ruleset from the community repository.

Wazuh

Wazuh is a free, open-source security platform that combines SIEM functionality, endpoint detection, vulnerability management, and compliance monitoring. For organizations without an existing enterprise SIEM, Wazuh provides a deployable, production-capable detection platform at no licensing cost. Its agent-based architecture collects logs, file integrity monitoring data, and process information from endpoints. The built-in ruleset covers common attack patterns and can be extended with custom rules. During incident response, Wazuh's real-time alerting and centralized log search significantly accelerate triage across multiple affected systems.

Containment Tools

Containment stops the bleeding. The goal is to prevent the attacker from moving further while preserving enough system state for forensic collection. Speed and precision both matter — containment that destroys evidence or takes down business-critical services creates new problems while solving the original one.

Network Isolation

The most reliable containment action for a compromised Windows host is network isolation through the built-in Windows Firewall. A pre-written PowerShell script that blocks all inbound and outbound traffic except for the specific IP addresses needed for remote forensic collection can isolate a host in seconds without requiring physical access or EDR deployment. Keep this script on your jump kit, tested and ready to execute via PsExec or your endpoint management platform.

For Linux hosts, a simple iptables or nftables ruleset achieves the same isolation. The key is having these scripts written, tested, and version-controlled before an incident, so that containment is a matter of executing a known-good script rather than writing firewall rules under pressure.

EDR Platforms

If your organization has an EDR deployed, its containment capabilities — network isolation, process termination, file quarantine — are typically the fastest path to host-level containment. Even free or lower-cost EDR options like Microsoft Defender for Endpoint (included with many Microsoft 365 licenses) provide meaningful containment capabilities. The preparation step is ensuring your EDR is deployed across your critical asset inventory and that your IR team has the access and training to use its containment features before an incident. An EDR that is deployed but unfamiliar to responders provides minimal value in the first hour of response.

Firewall Rule Generators

For network-level containment that does not depend on host-level access — essential when a host may be too compromised to trust local execution — having pre-built firewall rule templates for your network devices enables rapid network segmentation. Maintain a library of ACL templates and firewall rule sets for your specific network equipment, covering common containment scenarios: isolating a VLAN, blocking specific source IPs, and restricting outbound traffic to specific destinations. The Firewall Builder open-source project provides a policy management interface for multiple firewall platforms that simplifies generating consistent rule sets.

Forensic Collection Tools

Forensic collection preserves evidence before it is lost to system changes, log rotation, or attacker cleanup. Collection must be forensically sound — write-blocked, hashed, and documented — to support any downstream legal or regulatory process.

KAPE (Kroll Artifact Parser and Extractor)

KAPE is the standard tool for targeted forensic artifact collection on Windows systems. Rather than imaging an entire disk — which can take hours for large drives — KAPE collects specific artifact categories defined by modular target configurations. Pre-built targets cover Windows event logs, browser history, prefetch files, registry hives, LNK files, shellbags, SRUM data, and dozens of other forensically significant locations. A typical KAPE collection of the most valuable IR artifacts completes in minutes rather than hours, making it practical for rapid triage collection before a full disk image is acquired.

KAPE also includes processor modules that run analysis tools against collected artifacts, enabling triage analysis while collection continues. Keep KAPE on your jump kit with a standard set of targets tuned to your most common incident types, tested against your environment's Windows versions.

Velociraptor

Velociraptor is an open-source endpoint visibility and digital forensics platform that enables remote, scalable artifact collection across an entire fleet. Where KAPE is a local collection tool, Velociraptor is a client-server architecture: deploy the Velociraptor agent to endpoints, and an analyst can remotely collect artifacts, run VQL (Velociraptor Query Language) queries, and perform triage across hundreds of systems simultaneously from a central console.

For organizations responding to broad intrusions affecting many systems, Velociraptor is transformative. A single analyst can run the equivalent of a KAPE collection across fifty systems in parallel, collect memory images remotely, and hunt for specific IOCs across the entire fleet — tasks that would require days of manual effort without centralized collection infrastructure. Deploy Velociraptor as a preparation-phase project and train your team on VQL before you need it under pressure.

Memory Acquisition

WinPmem is the open-source standard for Windows memory acquisition, producing raw memory images compatible with Volatility for analysis. DumpIt (Magnet Forensics, free version available) is an alternative that produces Microsoft crash dump format output and is reliable in enterprise environments. For Linux memory acquisition, LiME (Linux Memory Extractor) is the de facto standard — it requires compiling a kernel module for the specific kernel version in your environment, so pre-compile LiME modules for every kernel version running in production as a preparation step.

Memory acquisition should happen before any other collection action on a live system. The order of volatility principle places RAM first precisely because it disappears at shutdown. Keep acquisition tools on write-protected USB drives with sufficient capacity for the largest systems in your environment.

Disk Imaging

dc3dd is a forensic enhancement of the GNU dd utility, adding on-the-fly hashing, progress reporting, and error handling appropriate for forensic imaging. It produces images compatible with all major forensic analysis platforms. For faster imaging over network connections, FTK Imager Lite (AccessData, free) provides a GUI-based imaging tool that supports multiple output formats and built-in hash verification. Both tools produce court-admissible forensic images when used with appropriate write-blocking hardware.

Analysis Tools

Analysis tools extract investigative meaning from the collected evidence. This is where the forensic work happens: reconstructing timelines, identifying malicious activity, attributing actions to actors, and answering the questions that drive incident scoping and remediation decisions.

Volatility

Volatility 3 is the industry-standard open-source framework for memory forensics analysis. It provides a plugin-based architecture for extracting operating system data structures from raw memory images: running processes, network connections, loaded modules, injected code regions, registry hives, and dozens of other artifacts. Volatility 3 no longer requires traditional profiles — it identifies the OS build from the image and downloads the appropriate symbol tables automatically.

The essential plugins for IR triage are windows.pslist and windows.psscan for process analysis, windows.netscan for network connections, windows.malfind for injected code detection, windows.dlllist for loaded module inspection, and windows.cmdline for process argument recovery. Build familiarity with these plugins through regular practice on sample memory images before you need them in a real incident.

Autopsy and The Sleuth Kit

Autopsy is an open-source digital forensics platform built on top of The Sleuth Kit library. It provides a GUI-based interface for disk image analysis, timeline reconstruction, keyword search, file carving, and artifact extraction. Autopsy handles the most common disk forensics tasks that arise in IR work: recovering deleted files, analyzing browser artifacts, extracting email data, and building file system timelines.

The Autopsy module ecosystem extends the platform significantly — modules for email analysis, hash set matching against NSRL, and timeline visualization are all available. For teams that need a comprehensive disk forensics platform without a commercial license, Autopsy provides the core capabilities of commercial tools at no cost. The trade-off is processing speed and the learning investment required to use it effectively, both of which favor preparation-phase training over incident-phase discovery.

Plaso and log2timeline

Plaso (Python Log2timeline) is a timeline extraction engine that processes dozens of artifact types — event logs, file system timestamps, browser history, registry entries, prefetch files, and more — into a unified super-timeline. The log2timeline.py tool processes the source artifacts, and psort.py filters and sorts the output for analysis in tools like Timesketch, an open-source collaborative timeline analysis platform designed for large-scale IR investigations.

Super-timeline analysis is particularly powerful for reconstructing attacker activity sequences, establishing when specific actions occurred relative to each other, and identifying gaps in the timeline that may indicate attacker anti-forensics activity. The preparation investment in Plaso is learning the tool syntax and building processing scripts for your standard artifact collections before you need them under pressure.

Chainsaw and Hayabusa

Chainsaw (F-Secure Labs, open-source) is a Windows event log analysis tool that applies Sigma detection rules and built-in hunting rules to EVTX files, rapidly surfacing suspicious patterns without requiring a SIEM. It processes event logs collected from a compromised host and outputs matches against community detection rules, providing a fast triage layer before deeper analysis. Hayabusa serves a similar function with an emphasis on timeline generation from Windows event logs and a comprehensive rule set maintained by the Yamato Security community. Both tools run against offline EVTX collections, making them ideal for post-collection analysis of event logs extracted via KAPE or manual collection.

For rapid event log triage, Chainsaw and Hayabusa are dramatically faster than manually loading event logs into Event Viewer or a SIEM. A typical Chainsaw or Hayabusa run against a full event log collection completes in seconds and immediately surfaces the highest-priority findings for analyst review.

Recovery and Hardening Tools

Recovery is the phase where systems return to normal operations and security posture is improved to prevent recurrence. The tools here support validating that recovery is complete and that the security gaps exploited during the incident have been addressed.

Backup Verification

Recovery depends on backup integrity. Before an incident, verify that your backups are complete, consistent, and actually recoverable — a backup that has never been tested is a hypothesis, not a recovery capability. Veeam (free Community Edition available) provides backup management with built-in integrity verification and test restore capabilities for virtual environments. For file-level verification, maintaining SHA-256 checksums of critical system configurations and application binaries provides a integrity baseline that can confirm whether a restored system matches its known-good state.

Patch Management

Post-incident hardening requires rapid identification and remediation of the vulnerability or configuration weakness that enabled the initial access. OpenVAS (Greenbone Vulnerability Manager, open-source) provides comprehensive vulnerability scanning capabilities without licensing cost. Run OpenVAS against recovered systems before returning them to production to confirm that the exploited vulnerability and any related weaknesses have been remediated. The CVSS-based prioritization in OpenVAS output helps focus remediation effort on the highest-risk findings first.

Configuration Auditing

Lynis is an open-source security auditing tool for Linux and Unix-based systems. It performs a comprehensive configuration audit covering authentication settings, file permissions, network configuration, installed software, and dozens of other security controls, producing a hardening report with specific remediation recommendations. Run Lynis against recovered Linux systems as part of the post-incident hardening process to identify configuration weaknesses that may not have been directly exploited but represent residual risk.

For Windows environments, Microsoft Security Compliance Toolkit (free) provides baseline policy templates aligned to CIS benchmarks and Microsoft security guidance, along with tools to compare running system configurations against those baselines. Combined with PingCastle (free for non-commercial use) for Active Directory security assessment, these tools provide a comprehensive post-incident configuration review capability for Windows-centric environments.

Toolkit Organization

Having the right tools is necessary but not sufficient. A toolkit that responders cannot quickly navigate under pressure — because it is disorganized, out of date, or unfamiliar — provides less value than a smaller, well-organized, well-practiced collection. Toolkit organization is an investment that pays dividends every time the toolkit is used.

Jump Kit Structure

The physical IR jump kit — typically a USB drive or drives carried by responders — should be organized to match the response workflow. A structure that works well in practice:

Version Management

Tool versions change. New releases fix bugs, add capabilities, and sometimes break compatibility with existing workflows. Manage your toolkit versions the same way you manage software in production: pin specific versions, test updates before adopting them, and document version changes in a changelog. A versions.txt file in each toolkit directory listing the tool name, version, source URL, and download date provides the audit trail needed for evidentiary defensibility and for troubleshooting when tool behavior differs from expectations.

Store the canonical toolkit in a version-controlled repository — a private Git repository with large file support via Git LFS works well for binaries. This enables rolling back to a previous known-good state if a tool update introduces problems, and provides a change history that supports regulatory and legal defensibility requirements.

Deployment Scripts

For tools that need to be deployed remotely during an incident — Velociraptor agents, Sysmon configurations, collection scripts — maintain deployment scripts that are tested, parameterized for your environment, and ready to execute. A deployment script that requires manual editing during an incident introduces delay and error. Scripts should accept the target system or IP range as a parameter and handle the full deployment workflow: file transfer, execution, verification, and cleanup. Test deployment scripts quarterly as part of your IR readiness program, not just when you need them during a real incident.

Maintenance Cadence

A toolkit that is not maintained degrades. Rule sets go stale, tool versions fall behind, and scripts break against updated operating system versions. Establish a quarterly toolkit review process: update tool versions, refresh YARA and Sigma rule sets from community repositories, test deployment scripts against current OS versions in your lab environment, and verify that all hashes in your integrity manifest are current. Document the review date and reviewer in your toolkit changelog. Teams that maintain this cadence consistently have toolkits that work when they are needed; teams that defer maintenance discover failures at the worst possible moment.

The open-source IR tooling ecosystem evolves rapidly. New tools emerge, established tools gain significant capabilities, and community rule sets grow continuously. Staying current is itself a discipline — one best addressed through a structured maintenance process rather than ad-hoc updates driven by encountering a tool's limitations during an active incident.

For a structured approach to putting these tools into practice, the Ransomware Response: First 60 Minutes guide walks through the tool-by-tool workflow for one of the most time-critical IR scenarios, and the Cloud Incident Response guide covers the adapted toolkit and workflow required when incidents span cloud environments.

Ready Your Incident Response Program

Tools are only effective with the right processes and trained teams behind them. Learn how ForgeWork helps organizations build comprehensive IR capabilities.

IR Services IR Checklist →