Kansa
A modular PowerShell framework for enterprise incident response and breach hunting using remote data collection.
What is Kansa?
Kansa is a modular incident response framework built in PowerShell that automates forensic data collection across enterprise Windows systems. It uses PowerShell Remoting to execute security modules on remote hosts, helping teams investigate breaches, hunt for threats, or establish system baselines. The framework outputs structured data for analysis, streamlining the incident response process.
Security analysts, incident responders, and IT professionals managing Windows-based enterprise environments who need to collect and analyze forensic data during security incidents.
Kansa offers a scalable, modular approach to incident response with PowerShell-native integration, enabling rapid data collection across thousands of systems without relying on commercial tools. Its open-source nature and extensible module system provide flexibility for custom forensic workflows.
Overview
A Powershell incident response framework
Use Cases
Best For
- Collecting forensic evidence across multiple Windows hosts during a security incident
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.