GitNote is the index I wish existed when I started in DFIR — a single, opinionated entry point to the references I actually use, organized so that someone walking in cold can find what they need in under 60 seconds.

It is not an "awesome list" of everything in security. It is a curated, used-in-practice subset of:

• 🔍 Incident response frameworks — 66 IR/DFIR doctrine PDFs from NIST, SANS, ENISA, KISA, Microsoft, AWS, and more
• 📚 Resources — practical guides on phishing analysis, blue team notes, red team tools, mindmaps for tcpdump / Burp / Windows privileges
• 💻 Code snippets — working scripts for reverse engineering, macOS setup, network checks
• ⭐ Curated stars — 204 GitHub repos categorized into 12 buckets (DFIR / Blue Team / AI / Red Team / Malware / OSINT / etc.)

GitNote/
├── 📂 Repositories/          ← 66 IR/DFIR doctrine PDFs (NIST, SANS, ENISA, KISA…)
│   └── Cyber-Incident-Investigation-Framework/
│       ├── NIST/              (6 PDFs — 800-61, 800-86, 800-150, log mgmt, malware, patch)
│       ├── SANS/              (36 PDFs — incident handling, IR programs, NetWars, etc.)
│       ├── ENISA/             (5 PDFs — EU CSIRT guidance)
│       ├── KISA/              (2 PDFs — Korean IR guides 한국어)
│       ├── Microsoft/         (Microsoft IR Reference Guide)
│       ├── AWS/               (AWS Security Incident Response Guide)
│       ├── ACSC/              (Australian Cyber Security Centre)
│       ├── CREST/             (Cyber Security Incident Response Guide)
│       ├── FCC/               (Computer Security Incident Response Guide)
│       └── …16 organizations total
│
├── 📂 Resources/             ← Working guides + curated indexes
│   ├── awesome-stars.md       ⭐ 204 GitHub stars categorized (DFIR/Blue/AI/Red/etc.)
│   ├── [Guide] blue-team-notes.md
│   ├── [Guide] blue-team-notes_examples-of-lateral-movement.md
│   ├── [Guide] markdown-korean.md
│   ├── [Tips-and-Tricks] phishing-email-analysis.md
│   ├── [Tips-and-Tricks] chatgpt-sheat-sheet.md
│   ├── [Tips-and-Tricks] how-to-copy-github-wiki.md
│   ├── [Resources] red-team-tools.md
│   ├── [Resources] program-analysis.md
│   ├── [Resources] assembly-language.md
│   └── [Mindmap] Tools/        (tcpdump / Burpsuite / Windows Privileges — visual cheatsheets)
│
└── 📂 CodeSnippets/         ← Working scripts (reverse engineering, setup, networking)
    ├── reversing_dump-pyc-with-gdb.md       (RE technique walkthrough)
    ├── reversing_dump-pyc-with-gdb_*.py     (3 helper scripts)
    ├── setup-macos-full-20240204.sh         (full macOS dev/forensics workstation setup)
    ├── LunarToSolarEventCreator.py          (calendar utility)
    ├── network_checkip.py                   (IP enrichment helper)
    └── misc_live-gif-macker.py              (GIF capture tool)

1. [Resources] dfir-2026-essential-reading.md ⭐ — 2026 reading list (M-Trends, DBIR, DFIR Report, books, training)
2. NIST SP 800-61 r2 — foundational
3. NIST SP 800-86 — forensic integration
4. SANS — Incident Handler's Handbook

1. [Cheatsheet] evtx-threat-hunting-2026.md — Sigma rules + Hayabusa one-liners
2. [Playbook] identity-attacks-detection.md — AD + Entra ID detection signatures
3. awesome-stars.md → Blue Team section — 17 SOC/detection-engineering tools

1. [Cheatsheet] macos-unified-log-triage.md — 12 working log show predicates
2. launchd_persistence_audit.sh — comprehensive launchd persistence inventory
3. Companion repos by the same author:
   • yushin-mac-forensics-platform — Flask-based macOS DFIR platform
   • yushin-mac-artifact-collector — single-file macOS artifact collector

1. [Cheatsheet] cloud-dfir-aws-entra.md — AWS CloudTrail + Entra ID signatures
2. [Playbook] identity-attacks-detection.md — modern Entra ID attacks (device code, PRT theft, MFA fatigue)

Resources/awesome-stars.md — 204 starred GitHub repos, auto-classified into 12 categories with manual review.

Yushin (방주원 / バン ジュウォン / 優心) is a DFIR Senior Specialist based in Tokyo, focused on autonomous security operations, agentic DFIR, and macOS forensics. The Japanese reading 優心 means "discerning mind" — the trait this knowledge base is meant to help cultivate.

• 🔗 GitHub: @Juwon1405
• 🌍 Location: Tokyo, Japan
• 🎓 Domain: DFIR · Detection Engineering · Incident Response · macOS Forensics

Documents in Repositories/ retain their original licenses (NIST/SANS/ENISA/etc. publications are public domain or under their respective publisher terms). Original content (Resources/, CodeSnippets/, this README) is offered under CC BY 4.0 unless otherwise specified within a file.

If a referenced PDF here belongs to you and you'd like it removed or re-attributed, please open an issue.