Free Tools for Security Operations
Production-ready references and interactive tools extracted from across the Ridgeline course catalog. Use them during investigations, share them with your team, bookmark them for 2 AM. Every tool links to the course that teaches the full methodology behind it.
No account required. No paywall. Built for practitioners.
Investigation & Response Tools
DFIR Investigation Runbooks
Structured response procedures for the incidents SOC analysts handle most often. Identity compromise, malware, lateral movement, BEC, ransomware, data exfiltration, and privilege escalation. Six phases per runbook: triage, scope, preserve, contain, verify, handoff.
Incident Triage Scorecard
Classify any security alert in under 5 minutes. Eight questions that produce a defensible severity classification with recommended next steps. Works for identity, endpoint, email, and network alerts across cloud, Windows, and Linux.
Windows Forensic Artifacts Reference
Every artifact a responder needs — persistence mechanisms, execution evidence, file activity, network indicators, account usage, USB device history, and event log forensics. Registry paths, extraction tools, and what to look for.
Windows Event ID Reference
The event IDs that matter for security operations — authentication, process creation, Sysmon, PowerShell, Defender, Kerberos, and more. What each event means, which log it lives in, and what to look for during an investigation.
Detection & Endpoint Tools
KQL Query Reference
Production KQL queries for Microsoft Sentinel and Defender XDR. Organized by ATT&CK tactic — credential access, lateral movement, persistence, defense evasion, exfiltration. Searchable, filterable, copy-ready.
ASR Rules Quick Reference
Every Attack Surface Reduction rule categorized by deployment risk — Safe, Careful, and High-Risk. Each rule includes the ATT&CK technique it defends, common false positives, recommended audit period, and deployment guidance.
PowerShell for Security Operations
The PowerShell commands defenders actually use during investigations and triage. Organized by ATT&CK tactic — discovery, persistence, credential access, lateral movement, collection, defense evasion, exfiltration, and containment actions.
Every tool is extracted from a Ridgeline course.
The tools give you the reference. The courses teach the methodology, judgment, and operational context. Browse All Courses or start a free module.