Forensicator

Forensicator is ranked #3 of 21 in incident response software on The Geeks Club. It runs on API, Linux, macOS, Self-hosted, Web, Windows. There is a free plan.

Forensicator plans and pricing

All plans

Forensicator Free Free and open-source cross-platform incident response toolkit forensicator.io · 29 Sept 2026

Forensicator Enterprise Not published Request a demo / contact sales Self-hosted; deployment and pricing details not stated forensicator.io · 29 Sept 2026

Compared on incident response software

Free plan: Yes
Case management: Yes
Evidence tracking: Yes
Responder collaboration: Yes
Audit log: Yes
API access: Yes
Deployment options: self_hosted

Best Forensicator alternatives

See all 12

7.9 LimaCharlie Free plan

7.3 Binalyze AIR Free trial

7.1 ORNA Free plan

7.0 Forendi Free trial $199/mo

6.7 Cyber Triage Free trial $291.67/mo

6.6 Cydarm Free trial

Forensicator

Purpose: Forensicator collects, analyzes, and interprets system artifacts during live investigations and produces structured HTML reports.
AI investigation: Forensicator AI offers optional per-finding verdicts and a cross-finding summary with a risk score, timeline, and attack chain on Windows.
AI providers: AI analysis can use local Ollama or commercial providers including OpenAI, Azure OpenAI, Anthropic, or an OpenAI-compatible endpoint.
Detection: The toolkit evaluates more than 1,400 community Sigma rules, with coverage and data sources varying by operating system.
Threat intelligence: Malware hash and IOC matching uses auto-updating threat-intelligence feeds, including abuse.ch and URLhaus.
Collection features: Windows collection includes RAM acquisition through WinPmem and live network capture converted to PCAP for Wireshark.
Encryption: Collected artifacts can be encrypted with AES; artifact decryption is available on Windows and Linux, but not macOS.
Reports and output: Runs produce a searchable HTML report and a structured investigation JSON folder; Windows also produces a case-summary JSON rollup.
Setup: The collector runs from a cloned repository without an agent or provisioning, and requires elevated permissions for full artifact access.
Notable limits: Forensicator AI, the Investigation Summary, and Active Directory/MSSQL/SharePoint detection are Windows-only; macOS Sigma coverage is narrower than on Windows and Linux.
Enterprise: Forensicator Enterprise is self-hosted software for uploading, correlating, and managing collector reports across teams.
Enterprise integrations: Enterprise exposes an authenticated REST API, webhooks, and structured JSON export; specific SIEM, ticketing, or SOAR integrations are not listed.
Security: Enterprise describes organization-scoped role-based access, hashed API keys, activity logging, configurable data retention, and local-model support for offline AI analysis.
Audience: Enterprise is presented for security operations centers, incident response and digital forensics teams, and MSSPs.
Price from: Free

Visit site Alternatives

Where it ranks on The Geeks Club

Best Incident Response Software in 2026#3 of 21

Is Forensicator yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Forensicator

Sources

opendocs.forensicator.io· checked 29 Sept 2026
forensicator.io· checked 29 Sept 2026
forensicator.io/enterprise· checked 29 Sept 2026