n8n node for DFIR IRIS IRP

DFIR IRIS node integration for n8n with stable and next API support

Binalyze AIR nodes for automating DFIR with n8n workflows

n8n community node for the DFIR Platform API — phishing analysis, IOC enrichment, exposure scanning, and AI triage

⚠️ AI-GENERATED — has known bugs, NOT production-ready. n8n community node for Velociraptor DFIR platform via gRPC API

Tigma is a fully compliant library for loading, parsing, and validating Sigma rules in a JS environment (browser or node). This enables Sigma to reach even further by opening up new platforms supporting Javascript (almost anything out there).

AWS Security MCP Server – GuardDuty/SecurityHub/Inspector findings, security service status checks, and S3/EBS encryption audits for security investigations

Reusable project context and specialist workflows for the AI tools you already use. AIWG places agents, skills, commands, and rules in provider-readable locations, with optional utilities for artifact memory, workflow orchestration, recovery, and discover

MCP server exposing CyberChef's 504 data-transformation operations -- encryption, encoding, compression, forensics -- as tools for AI assistants.

Incident timeline and attack diagram generator for security teams. Zero runtime dependencies, pluggable storage, runs in any browser.

AWS Lambda MCP Server – function discovery, configuration inspection, resource policy analysis, event source mapping enumeration, and function URL exposure checks for security investigations

AWS Network MCP Server – VPC inspection, security group analysis, ENI details, flow log queries, and IP address lookup for security investigations

AWS S3 MCP Server – bucket inventory, public exposure detection, policy/ACL analysis, and object listing for data exfiltration investigations

Splunk MCP Server – SPL search execution, index/sourcetype discovery, saved searches, and health checks for security investigations

AWS EC2 MCP Server – instance inventory, security group exposure analysis, user-data inspection, and console output forensics for incident response

AWS CloudWatch MCP Server – Logs Insights queries, log stream events, alarm status, and metric statistics for security investigations

AWS IAM MCP Server – user/role inspection, policy analysis, access key audit, and privilege simulation for security investigations

AWS CloudTrail MCP Server – audit log lookup, CloudTrail Lake SQL analytics, and event data store management for security investigations

Reusable project context and specialist workflows for the AI tools you already use. AIWG places agents, skills, commands, and rules in provider-readable locations, with optional utilities for artifact memory, workflow orchestration, recovery, and discover