GRR Rapid Response is an incident response framework focused on remote live forensics.
The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely.
GRR consists of 2 parts: client and server.
GRR client is deployed on systems that one might want to investigate. On every such system, once deployed, GRR client periodically polls GRR frontend servers for work. “Work” means running a specific action: downloading file, listing a directory, etc.
GRR server infrastructure consists of several components (frontends, workers, UI servers) and provides web-based graphical user interface and an API endpoint that allows analysts to schedule actions on clients and view and process collected data.
Key Features
- Client:
- Live remote memory analysis using YARA library.
- Powerful search and download capabilities for files and the Windows registry.
- OS-level and raw file system access, using the SleuthKit (TSK).
- Secure communication infrastructure designed for Internet deployment.
- Detailed monitoring of client CPU, memory, IO usage and self-imposed limits.
- Cross-platform support for Linux, OS X and Windows clients.
- Server:
- Fully fledged response capabilities handling most incident response and forensics tasks.
- Enterprise hunting (searching across a fleet of machines) support.
- Fast and simple collection of hundreds of digital forensic artifacts.
- AngularJS Web UI and RESTful JSON API with client libraries in Python, PowerShell and Go.
- Powerful data export features supporting variety of formats and output plugins.
- Fully scalable back-end capable of handling large deployments.
- Automated scheduling for recurring tasks.
- Asynchronous design allowing future task scheduling for clients, designed to work with a large fleet of laptops.
Website: github.com/google/grr
Support: Mailing List
Developer: Mikhail Bushkov, Ben Galehouse, Łukasz Hanuszczak, Andreas Moser, Denver Ogaro, Max Vogler
License: Apache License 2.0
GRR is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Digital Forensics Tools | |
|---|---|
| GRR Rapid Response | Remote live forensics for incident response |
| Radare2 | Portable reversing framework |
| The Sleuth Kit | Collection of tools for forensic analysis |
| Autopsy Forensic Browser | Graphical interface to SleuthKit |
| iaito | Official graphical interface for radare2 |
| Volatility | Advanced memory forensics framework |
| guymager | Forensic imaging tool based on Qt |
| dcfldd | Enhanced version of dd for forensics and security |
| rdd | Forensic copy program |
| Jomon | Network forensics and passive sniffer |
| Mozilla InvestiGator | Real-time digital forensics and investigation platform |
| Velociraptor | Endpoint visibility and collection tool |
| Timesketch | Collaborative forensic timeline analysis |
| Plaso | Python-based digital forensics framework |
| MemProcFS | View physical memory as files in a virtual file system |
| Chainsaw | Fast forensic triage and threat hunting tool for Windows artefacts |
Read our verdict in the software roundup.
| Incident Response | |
|---|---|
| GRR | Remote live forensics for incident response |
| GoAlert | On-call scheduling, automated escalations and notifications |
| OneUptime | Unified observability, on-call scheduling, and incident response |
| Keep | AI-powered alert correlation and workflow automation for operations teams |
| Alertmanager | Handles alerts sent by client applications such as the Prometheus server |
| Shuffle | Connects security tools to automate workflows and accelerate response |
| Velociraptor | Endpoint visibility and collection tool |
| DFIR-IRIS | Collaborative case management for forensics and incident response. |
| FIR | Cybersecurity incident management platform |
| Iris | Automated incident paging system at LinkedIn |
| Dispatch | Manage security incidents by deeply integrating with existing tools |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.