KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #typescript #claude-code #codex #dsh #dsh-plugin #ai-agent #ai-agents #deepseek-harness #agent-skills #macos #cli

DFIR-Reference-Frameworks

★ 122 Open GitHub ↗

Repository of public reference frameworks for the DFIR community.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# DFIR Reference Frameworks
This repository is intended to provide a public reference to frameworks directly relevant to the DFIR community. It's common for the DFIR community to use terminology that isn't always well defined in the documentation they produce. This repository aims to help the DFIR community, and those reading information from the DFIR community, have a better understanding of defined terms and a more consistent approach to the language used in documentation.

*Given the DFIR community is not a regulated industry, it's not common to find academic peer-reviewed papers for the majority of the topics below. For this reason, the Frameworks provided below are considered commonly used/accepted within the industry, or originate from well-known educational resrouces. This repository is not intended as a reference location to individual vendor methodologies. Any changes submitted need to show that the source meets these requirements.*

## Use of this Repository
You're welcome, and I encourage, you to use the references provided below. All I ask is if you find other useful references you drop me an Issue with the link and why you think it's useful, so I can add it for others to benefit from. Additoinally, if you really enjoy using these references, shoot me an email or a message just to let me know this was useful....that's it, enjoy.

## **Incident Response**

* [NIST Computer Security Incident Handling Guide](https://www.nist.gov/privacy-framework/nist-sp-800-61)

### Malware Analysis

* [NIST Guide to Malware Incident Prevention and Handling for Desktops and Laptops](https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final)

## **Threat Intelligence**

|Description | Author | Link|
|-|-|-|
|CTI Source Analysis/Assessment Framework|Sergio Caltagirone, Andrew Pendergast, Christopher Betz|[The Diamond Model of Intrusion Analysis](http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf)|
|CTI Likelihood and Confidence Taxonomies|MISP|[MISP Estimative Language](https://github.com/MISP/misp-taxonomies/blob/main/estimative-language/machinetag.json)|
|CTI Structured Language|MITRE|[Structured Threat Information Expression (STIX™)](https://oasis-open.github.io/cti-documentation/stix/intro)|
|Transport Framework for Sharing CTI|MITRE|[Trusted Automated Exchange of Intelligence Information (TAXII™)](https://oasis-open.github.io/cti-documentation/taxii/intro)|
|Assessing CTI Feeds Value|Kimberly K. Watson|[Assessing The Potential Value Of Cyber Threat Intelligence (CTI) Feeds](https://www.cisa.gov/sites/default/files/publications/Assessing%20Cyber%20Threat%20Intelligence%20Threat%20Feeds_508c.pdf)|

## **Proactive Response**

### Threat Hunting

### Insider Threat
|Description | Author | Link|
|-|-|-|
|Detecting and Identifying Insider Threats and Methodology|CISA|[Detecting and Identifying Insider Threats](https://www.cisa.gov/detecting-and-identifying-insider-threats)|
|Whitepaper on Behaviour Indicators of Insider Threats|Eric D. Shaw, Ph.D. and Harley V. Stock, Ph.D|[Behavioral Risk Indicators of Malicious Insider Theft of Intellectual Property: Misreading the Writing on the Wall](https://static1.squarespace.com/static/596a623ba5790afcec9c024e/t/59c9e063a803bb62117213c0/1506402404657/Symantec+Malicious+Insider+Whitepaper+FINAL2.pdf)|
|An Insider Threat Indicator Ontology Research Papaer|Carnegie Mellon University|[An Insider Threat Indicator Ontology](https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=454613)|
|Insider Threat Detection Case Study|NATO|[Insider Threat Detection Study](https://ccdcoe.org/uploads/2018/10/Insider_Threat_Study_CCDCOE.pdf)|
|Insider Threat Detection and Approach from CrowdStrike|Venu Shastri - CrowdStrike|[Detecting Insider Threat Indicators](https://www.crowdstrike.com/cybersecurity-101/insider-threats/insider-threat-indicators/)|
|Insider Threat Detection for the Cloud|Dave Shackleford|[How to Build a Detection and Response Strategy for Insider Threats](https://www.sans.org/white-papers/how-to-build-detection-response-strategy-for-insider-threats/)|

## **Digital Forensics**

|Description | Author | Link|
|-|-|-|

DFIR-Reference-Frameworks

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README