Freedom251 › Incident Response Software
Forensicator
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Forensicator | Free and open-source cross-platform incident response toolkit | Free |
| Forensicator Core | self-hosted · Docker Compose or Debian/Ubuntu · source available | Free |
| Forensicator Enterprise | self-hosted · team collaboration · organization-scoped access · audit history · API and webhooks | On request |
As forensicator.io lists them, read 29 Sept 2026. The maker's own page has the final word.
Facts from Forensicator's own pages
- AI investigation
- Forensicator AI offers optional per-finding verdicts and a cross-finding summary with a risk score, timeline, and attack chain on Windows. · opendocs.forensicator.io, 29 Sept 2026
- AI providers
- AI analysis can use local Ollama or commercial providers including OpenAI, Azure OpenAI, Anthropic, or an OpenAI-compatible endpoint. · opendocs.forensicator.io, 29 Sept 2026
- API
- Core provides REST API keys for integrations and automation. · forensicator.io, 15 Oct 2026
- Audience
- Enterprise is presented for security operations centers, incident response and digital forensics teams, and MSSPs. · forensicator.io, 29 Sept 2026
- Case management
- Core organizes investigations, hosts, findings, notes, bookmarks, and incident-response playbooks into cases. · forensicator.io, 15 Oct 2026
- Collection features
- Windows collection includes RAM acquisition through WinPmem and live network capture converted to PCAP for Wireshark. · forensicator.io, 29 Sept 2026
- Collector platforms
- The collector supports Windows PowerShell, Linux Bash, macOS Shell, and SSH-based network-device collection. · opendocs.forensicator.io, 15 Oct 2026
- Community visibility
- The GitHub repository page displayed 635 stars, 94 forks, and 350 commits when opened. · github.com, 15 Oct 2026
- Core analysis engines
- Core analyzes memory images with Volatility3, PCAP files, raw logs, and Windows forensic artifacts. · forensicator.io, 15 Oct 2026
- Deployment
- Core is self-hosted through Docker Compose or a Debian/Ubuntu host and supports offline update packages for air-gapped use. · forensicator.io, 15 Oct 2026
- Detection
- The toolkit evaluates more than 1,400 community Sigma rules, with coverage and data sources varying by operating system. · forensicator.io, 29 Sept 2026
- Directory availability
- Capterra's October 15, 2026 digital-forensics directory page listed 45 products but did not show Forensicator among the displayed products. · capterra.com, 15 Oct 2026
- Documentation
- The documentation site contains getting-started, Windows, Linux, macOS, output, advanced-usage, and changelog sections. · opendocs.forensicator.io, 15 Oct 2026
- Encryption
- Collected artifacts can be optionally encrypted with AES on Windows, Linux, macOS, and network devices. · opendocs.forensicator.io, 15 Oct 2026
- Enterprise
- Forensicator Enterprise is self-hosted software for uploading, correlating, and managing collector reports across teams. · forensicator.io, 29 Sept 2026
- Enterprise access control
- Enterprise provides organization-scoped role-based access, hashed prefix-indexed API keys, configurable retention, and activity logging. · forensicator.io, 15 Oct 2026
- Enterprise extensibility
- Enterprise exposes REST operations, webhooks, and structured JSON exports for ticketing, chat, SIEM, and SOAR integrations. · forensicator.io, 15 Oct 2026
- Enterprise integrations
- Enterprise exposes an authenticated REST API, webhooks, and structured JSON export; specific SIEM, ticketing, or SOAR integrations are not listed. · forensicator.io, 29 Sept 2026
- Enterprise workflow
- Enterprise accepts collector archives through an API-key-authenticated API or web interface and schema-validates findings on ingest. · forensicator.io, 15 Oct 2026
- Independent project listing
- SourceForge mirrors the Live-Forensicator GitHub project, lists Linux, Mac, and Windows, and showed eight downloads during the displayed week. · sourceforge.net, 15 Oct 2026
- Independent usage
- A Blue Team Labs Online case study used Live Forensicator to collect Windows event logs, identify account lockouts, inspect persistence registry keys, and review browser history. · linkedin.com, 15 Oct 2026
- License
- The documentation states that Forensicator is released under the MIT License. · opendocs.forensicator.io, 15 Oct 2026
- Limit: platform parity
- The documentation says AI, investigation summaries, and AD/MSSQL/SharePoint detection are Windows-only, while macOS Sigma coverage is narrower and macOS artifact decryption is unavailable. · opendocs.forensicator.io, 15 Oct 2026
- Limit: verbosity
- A LinkedIn DFIR discussion describes Live Forensicator as a quick alternative but says it is less verbose than Velociraptor on Windows. · linkedin.com, 15 Oct 2026
Where Forensicator stands on Freedom251
- Incident Response Software#2 of 21