#incident-response

Fast and efficient osquery management

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

Terraform provider for Rootly - manage incident management, on-call schedules, workflows, and alerts as code

Wazuh - Ansible playbook

Wazuh - Puppet module

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

An AIOps platform that closes the loop from Kubernetes alert to automated remediation: An AI Agent investigates via MCP tools, selects a fix from a pre-seeded workflow catalog and delegates execution (K8s Job, Tekton, Ansible) — or escalates with a full RCA. Approval gates, OPA policies, and audit trails keep humans in control.

Tenzir is the data pipeline engine for security teams.

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Import data into the incident.io Catalog from a variety of sources.

An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it — right from Slack, Telegram, Lark or DingTalk.

Convert source code into a repository-scale structural model. Air gapped, zero dependencies, SARIF and SBOM outputs.

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

Unified observability gateway for AI agents — one MCP server for Prometheus, Loki, and any backend, with cross-signal anomaly detection and a built-in Web UI.

GROOT — Kubernetes cluster diagnostics CLI Collect nodes, events, pod logs, describes and more with one command. Fast, parallel, configurable, and outputs a clean .tar.gz archive. Perfect for incident response and troubleshooting.