oss-forensics

To investigate an open-source software supply chain security incident, you can automate the collection and analysis of data from GitHub, GitHub Archive, Wayback Machine, and local git repositories to identify tampering or malicious activity. This Skill handles evidence collection, IOC identification, hypothesis formation, and structured reporting.

Yes, you can retrieve deleted commits, pull requests, issues, and releases during a GitHub forensics investigation by pulling historical data from the GitHub Archive and the Wayback Machine. This allows you to recover deleted content for evidence collection.

You can extract and enrich Indicators of Compromise by analyzing repository commits, pull requests, and events using the GitHub API and BigQuery. The process identifies potential IOCs and enriches them using public data sources to validate hypotheses about the incident.

Yes, you need Python and Git installed to automate open-source supply chain forensics, as the investigation scripts rely on them. You also need access to external services and APIs like GitHub and BigQuery for data retrieval and analysis.

The best way to generate structured forensic reports for repository tampering is to automate hypothesis formation and validation based on collected evidence and known attack patterns. This generates detailed reports featuring executive summaries, timelines, and actionable recommendations.

Yes, this supply chain security investigation tool works with local git repositories by collecting and analyzing local commit history and events. It combines this local data with remote sources like GitHub Archive to form a comprehensive view of the incident.