An open-source platform for collecting, processing, and analyzing forensic artifacts from macOS, Windows, and Linux systems.
Skadi is an open-source digital forensics and incident response platform that collects, processes, and analyzes forensic artifacts from macOS, Windows, and Linux systems. It integrates multiple tools to enable rapid hunting for evidence of malicious activities and scales from laptops to cloud environments.
Security professionals, incident responders, forensic analysts, and DFIR teams who need to perform host-based forensic collection and analysis across diverse operating systems.
Developers choose Skadi because it provides a pre-integrated suite of open-source forensic tools in a single platform, eliminating toolchain complexity and enabling scalable, cross-platform forensic investigations without proprietary software costs.
Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses integrated tools like CyLR to collect host-based data from macOS, Windows, and Linux systems, enabling multi-OS incident response.
Combines best-of-breed open-source tools such as CyberChef, Plaso, ElasticSearch, and TimeSketch into a single platform for streamlined artifact processing.
Provides a web portal with default credentials for easy access to all tools, reducing setup time and complexity.
Includes 11 Kibana dashboards out-of-the-box for forensic data visualization and timeline analysis, accelerating investigation workflows.
Incorporates Yeti for threat intelligence management, allowing correlation with forensic artifacts to enhance analysis.
Default web portal credentials (username and password both 'skadi') are a security vulnerability if not changed immediately after deployment.
Offers multiple deployment methods (OVA, Vagrant, Docker, Signed Installer) with separate wiki pages, which can be confusing and time-consuming to navigate.
Integrated tools like ElasticSearch and Kibana are memory-intensive, making Skadi unsuitable for low-resource environments or lightweight deployments.
Focused on post-incident forensic analysis rather than live response or continuous monitoring, which may not meet needs for proactive threat hunting.